{ "Event": { "published": true, "date": "2023-06-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-28", "timestamp": 1687996981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "51716345-6969-4b8b-90ce-b81377e97237", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb259ce-1597-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687945087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687945087, "uuid": "b1628cf4-7b8b-4e89-aaf5-c762633ad50f", "comment": "Malware payload (Formbook)", "value": "abf89b932e8ef30a751c9b989549ec89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687945087, "uuid": "647ffaf5-e80f-4e05-86f8-71905df5f97c", "comment": "Malware payload (Formbook)", "value": "011765b154e93fd26afc6331fa7330996162cd8b9ae00c938a630e6bcca2cc0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687945087, "uuid": "17d910cc-87b3-42be-8385-3c516eb2b907", "comment": "Malware payload (Formbook)", "value": "8270ac7261cf66ce1ee03bb46d59c25073307f3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687945087, "uuid": "e957f06d-3cc2-4e33-871d-984d34dfa0d7", "comment": "Malware payload (Formbook)", "value": "7c3c54524d387ba8b2d8e9e1362dfee19bac0a4b77ddd482f0e5b982ef5c9adb2f5d26fca73b51c90537962a74c9785f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687945087, "uuid": "ee03e8fe-9aef-420a-86a6-d72254f9a47e", "value": "T1FE3412046768D8B3D1B247B5DD7B171B6AE0A80610B8874F53846AEF7DB0D96904E3F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687945087, "uuid": "0c9c07e5-7e3c-4179-a1e8-3b9301bca88f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687945087, "uuid": "d3bcb8e2-0364-418f-a323-633d233b2153", "value": "6144:PYa6/RSn8Dy+MAUfNi65ScnbuxVugNFXzX6xfpEvlb:PYV0n83EfHYibuCgNFjX6xfGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687945087, "uuid": "302de05c-0bff-402b-8294-2fc39805fa01", "value": 244469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687945087, "uuid": "943894bf-e6cc-4ccc-a192-c2076663bdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687945087, "uuid": "d195809e-27d6-48ba-9fa4-c0000fffd525", "value": "RFx - NRSB-SPCI_QHK_NRSB_SPCI_115R1_023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4d3f59-15d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687973460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973460, "uuid": "8cc3c31d-9ab2-4abd-9210-f7013e34712a", "comment": "Malware payload (GuLoader)", "value": "3ee30f0b9e44cb1c347938d3afb5efcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973460, "uuid": "54d89b46-98f1-47e8-80f8-276ab884e192", "comment": "Malware payload (GuLoader)", "value": "023886a930cde30e5d1089fd678495fa01db6cdf96f1e5764c37570eec63ac6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973460, "uuid": "a2ab2a5b-845b-4e76-af12-4848c6fd3042", "comment": "Malware payload (GuLoader)", "value": "335af2d932a44f904d50eba26239d9855419ad94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973460, "uuid": "a1501f6d-2662-49eb-9615-a34cd1f0431a", "comment": "Malware payload (GuLoader)", "value": "17bfbdd95594a148180c28058c54a320202bd7371616413932cf6ec46911eb3530fbd574c69eea1fbab1ac0507c0dea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973460, "uuid": "e0292f3b-daf5-4bd2-af83-7990b9ad89f4", "value": "T1C0949CDD2AE1C51ACD61D7F00867DF745E30AE5CE9C0460AF6D43E9BB9332A2780E661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973460, "uuid": "06f8f603-9337-4d74-bb84-53b8143d8781", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973460, "uuid": "772b5769-0e9b-40da-bc1d-9ba66bdd6c14", "value": "6144:xmOP4gWqmzBeO29CDboxnfIfxpDJ303yY/sS4FmOfDBDuc:v7mVeOMSboxnfI7N3KUS18uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687973460, "uuid": "0717cbf5-bcd9-425a-8d67-665da4886d55", "value": 413346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687973460, "uuid": "02423551-e03b-4eae-850f-f1d1b2772b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973460, "uuid": "256bd238-73dc-4ca0-a853-aabd1204825f", "value": "SecuriteInfo.com.Trojan.NSIS.Agent.22628.17291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9402dec0-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687933100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933100, "uuid": "1a528973-b2f9-4648-9e3a-5ad0f250ac68", "comment": "Malware payload (SnakeKeylogger)", "value": "8ab9b70337b72969f8be5b1ab1137dc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933100, "uuid": "2ca67bad-fce4-4120-9f40-5db5d63b0077", "comment": "Malware payload (SnakeKeylogger)", "value": "024bfd09e9c0b5a0c81d377dc99b2a441f6651480c63b5ece0a4be575d659c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933100, "uuid": "144f8887-6fbc-4336-89e2-789433f7395e", "comment": "Malware payload (SnakeKeylogger)", "value": "7c647779360fa7ddc46c8a331fea764548314839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933100, "uuid": "a5f971a4-eac3-4db1-ae8a-0151d7bee840", "comment": "Malware payload (SnakeKeylogger)", "value": "7c175d0d92bf0ddcc9c07e50f513f864d49f22824ff33af84133cc169404d4910d9cc42c1cf62d8d03f5ff8ecd368a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933100, "uuid": "6d3e8125-cb6f-4e00-a35b-73ae3dc770d4", "value": "T1B3D4027A66E90F6FE5F4E8BE295819D0D3B484A14A13D1DBFDF5D8BB4086B90CB01183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933100, "uuid": "07d6ada7-aeff-48c8-95fb-2690ccfe4bf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933100, "uuid": "21ca8f51-5a00-4c83-a74c-e82079d798f7", "value": "12288:zjqj2iNG4/mNUAGAnw4fJo+Gy0RZp4Pwqtiim/tdgfyaO3c4Y/wvdl:zg1M4/QUP4Oi0fW0VdgfyaGcTAdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933100, "uuid": "416f76ce-a459-4bff-b35d-aa82440f3dbd", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933100, "uuid": "d7988c04-2e66-4aee-a4f1-7908e41e1826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933100, "uuid": "ca655774-9447-4ba6-9a87-beec49ece125", "value": "8ab9b70337b72969f8be5b1ab1137dc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8486dd-15f0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687983308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983308, "uuid": "57a63724-d8ae-43f7-92fc-bbfb472a408b", "comment": "Malware payload (RedLineStealer)", "value": "296d8d9f14a526b4f260b645051b9ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983308, "uuid": "6980b643-9479-47ca-a8d4-88c6868e6eef", "comment": "Malware payload (RedLineStealer)", "value": "025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983308, "uuid": "564bcbd0-54f3-497b-935e-617db6ba75cc", "comment": "Malware payload (RedLineStealer)", "value": "e4e7f4fa9fe7e4a38d18404836c37dcce0a7437e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983308, "uuid": "30780cab-8254-4f44-8403-3ceaf0553f26", "comment": "Malware payload (RedLineStealer)", "value": "5ffd1817d38c6263ce21331e83556b3e66dcf50895122819e30ea75e656b615694e7eb03559714a22af6aa592c46605c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983308, "uuid": "ca9b4359-a40a-4749-93cc-9e62d1ec7736", "value": "T1FE848D4392A17D95E929CB729E2FC6E8771DF2608E497B662238DF1F04B11B2D273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983308, "uuid": "2cbdf4dc-4436-4ef1-9f28-d7b72a990404", "value": "35c652ec2d2e6b7b1a97d833dcfa5b29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983308, "uuid": "a25dc224-b5c7-450e-a98f-7071cc4d0454", "value": "6144:yBYFcXdKyPQ7S1yPGwC7ULA6FPi9b4Gwxb:UYhyIF+gA6li9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687983308, "uuid": "391995ce-8bd2-4c5d-a56c-de24e009d484", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687983308, "uuid": "92c34119-0db2-479c-b7ba-298e09be8a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983308, "uuid": "27dd81d9-38bc-4377-a086-7eb490d059a2", "value": "296d8d9f14a526b4f260b645051b9ee7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007ac554-157c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687933282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933282, "uuid": "7e2da43a-285f-4637-b238-97bd754d55f5", "comment": "Malware payload (Loki)", "value": "c43de6a0ddfb3e3016de5b0bdf037f67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933282, "uuid": "92934b34-9f15-4172-b45e-070b3b123604", "comment": "Malware payload (Loki)", "value": "03b5b853e3e2fae29872f7f2f4d278d8feffb431d210a8c6b458053987d4fa00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933282, "uuid": "0ee655a4-7f0b-4df6-86ba-b70d970f514d", "comment": "Malware payload (Loki)", "value": "68de692f9a449ac782937aa10d4d2eb9f076ed32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933282, "uuid": "4bcf1efa-cf7f-46b7-9be2-75d2f4f0854d", "comment": "Malware payload (Loki)", "value": "c75c1f5a228648222866b92ce3503b03c5b9f7ca71676facb3e229a153936d58c2195855af63978bc1aadab7090688f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933282, "uuid": "338d7f9c-d31d-4151-9418-0224de808ff3", "value": "T1B5052838287D1B66C178C7F98ED18023F7A4953F3829E9255CC267E90A56FA215C363F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933282, "uuid": "f69307aa-9fe1-4791-b146-b3f9de223e39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933282, "uuid": "51c0f717-5e75-4d7a-a76d-5eda356bf98d", "value": "12288:BNK7k4sCSuIzu//IzWtdZkZeWe5VvUXi1Zb:BQ+Zza/sWtdV1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933282, "uuid": "aef52824-54db-45df-b7fe-717214197e04", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933282, "uuid": "00b89f55-443d-492b-a89f-e0e4b7da35c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933282, "uuid": "125119c1-9444-4225-9ef7-5be181ce37a3", "value": "FedEx_2711734880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b556e5-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962609, "uuid": "5e29bda0-ffc8-4e58-a3ff-4798834fc1e6", "comment": "Malware payload", "value": "95df4ced53df46621ce0302514b0a6a0", "object_relation": "md5", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962609, "uuid": "673ae40e-6d69-4ac8-9287-b66ac899c998", "comment": "Malware payload", "value": "03d93a10881d30d399c2ef0c90e6bc595452dded7224a5bd935576ad05405bcb", "object_relation": "sha256", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962609, "uuid": "26b48cde-6ca2-4729-8229-20bbb9ad132a", "comment": "Malware payload", "value": "3f09c332df075e4b132c7705774688e5a7554af7", "object_relation": "sha1", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962609, "uuid": "2a198c44-d3f5-4954-a464-10ae1525701a", "comment": "Malware payload", "value": "b418ce18d4e98ed59a1d7f8d27dac7a2bac8ed36252a7882f4118cf97fccfd62f68435406fcf1c9b4c56720af0cd9d13", "object_relation": "sha3-384", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962609, "uuid": "fbae6896-7a61-463d-89e6-6dcb33e86413", "value": "T13CB533F42AF511E3DF6FA6015561593EF90458FA6E3247CCCE99A20B830B7B4D69C09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962609, "uuid": "359d05ab-a6d6-4541-85da-e844876cf55f", "value": "49152:mSYmmQyNqDMOvHo4rkG4SxY8r3G/0eyNqDMOvHo4rkG4SH:mdmZyN6Dfo4jxYRpyN6Dfo4jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962609, "uuid": "05d3bdcf-d8ed-4a11-89c0-2665f9239b7e", "value": 2376118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962609, "uuid": "57b83d68-549b-4daf-9d81-814b2b6b89ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962609, "uuid": "c70ef817-5e9b-4eea-bbb9-9e76511167d0", "value": "Acrobat.Pro.2023.x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801a75db-1596-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687944663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944663, "uuid": "ea8ec174-7a68-4925-bb4a-5baf1efca255", "comment": "Malware payload (AgentTesla)", "value": "19fda5e9d4b1a5ef75ec0000adccea29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944663, "uuid": "561107a8-deb7-463d-aca6-80f1011c074f", "comment": "Malware payload (AgentTesla)", "value": "0501f9ee9fe9f858c159e067280b30badb60ce0e430abb1e60b3581edd8a971b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944663, "uuid": "1e63136f-4cd0-4660-a07f-2bc3b39aac18", "comment": "Malware payload (AgentTesla)", "value": "4ac63d456304b48a5e561a47da8a57a346086068", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944663, "uuid": "7ccda146-a7a8-420b-8888-c840ca2d5ab4", "comment": "Malware payload (AgentTesla)", "value": "f3e4db78e6f8b079b9f9976875020d81a2c38cd206d7a8fa5fb5dd468c94f050b279f0cf83c36a98ca9d68429f851a80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944663, "uuid": "9d2b3ce4-f63f-4948-ad73-a7ca097f3805", "value": "T125E4293C6B7D9A22C031D6B5CED584B3F2558F3AB511D523588A7BB12362B921DC332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944663, "uuid": "c89129f9-c80c-4ab1-991e-503c0bd6dbe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944663, "uuid": "8e796b12-da27-49d2-9b6d-4880b6f9a894", "value": "12288:Ncj6Xy6yWG/Ef9o5qZVbFW9BsoHYYC9umido0Tf843z6l:CO1/JValvmixTf8szI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687944663, "uuid": "3603c679-6fd5-4cbb-9bde-1f222df6f962", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687944663, "uuid": "e33eb72d-1779-41fe-937b-546a63c5cca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944663, "uuid": "c7d034aa-e3d4-4d2d-8b7b-03d4a4ee62b6", "value": "SecuriteInfo.com.Win32.PWSX-gen.24646.26086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0365fc68-1559-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918254, "uuid": "b05117d2-2868-4b3e-a88f-dac641827091", "comment": "Malware payload (Mirai)", "value": "ae952cc8b3ffff7ce167e59b6d590769", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918254, "uuid": "ba725a90-53d8-42ac-8504-404c55d6941a", "comment": "Malware payload (Mirai)", "value": "079b0c1afc7eb9c7fbf3261a7ff4f50f17364aa9848f3834ecdcb0e9f5a940a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918254, "uuid": "31b6422c-5893-4ccc-afc8-0e5d2a28d719", "comment": "Malware payload (Mirai)", "value": "3ffbff649972ee11586d79c7d1fddd524d345b66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918254, "uuid": "df660b58-65cd-41fe-a39f-ae1b7bd5151d", "comment": "Malware payload (Mirai)", "value": "5909cace18d2df3a7a68ad0451b70fa3c663d65f926506cb5b4f11fa8f71771f78f1aef4790dced33f95fd6684fa99f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918254, "uuid": "89106d5d-50a8-40d7-820f-1009c0e9e48b", "value": "T193336B36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918254, "uuid": "a039c323-dddb-40a8-972a-40f3e8607bdf", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918254, "uuid": "916b0515-e0d6-4145-ad6d-94bcd991bd3d", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918254, "uuid": "1b9a8bcf-a594-4d66-81c3-37538085a647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918254, "uuid": "7fc43346-bd30-4398-935c-b6b306d5bb36", "value": "ae952cc8b3ffff7ce167e59b6d590769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7519fb2e-1567-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687924458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924458, "uuid": "b903e6b8-936f-486e-9ad8-0950c54abe43", "comment": "Malware payload (AgentTesla)", "value": "d884898752a809e39203f30207e8b0c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924458, "uuid": "b631faba-e42e-4f22-af6e-3c5c4eddb7cb", "comment": "Malware payload (AgentTesla)", "value": "08cd319446765afe2881c8391688baa55af8eeddfb6c334a522a5232fc3d4f09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924458, "uuid": "b3be1e4c-7c46-4468-a73c-b2ce9356b729", "comment": "Malware payload (AgentTesla)", "value": "6f06fed0024a6a88570f3a18d62d8b649dc2e031", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924458, "uuid": "9f18fcbf-8e74-4248-967e-8193b7c19f6a", "comment": "Malware payload (AgentTesla)", "value": "413f8449f621b1979a088b9dd303735adbc9820d1fa7eb974f7b1d02d5d1fe21effcd70501074298107e2d8fea6c58dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924458, "uuid": "5a0783a7-43fa-4200-925d-b843df83000d", "value": "T15DE4483939BD5627D174C7E78FE3F023B278982B3121EA2568D657D90686F1225C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924458, "uuid": "2b28ade3-5828-476f-af37-e2b0b2d1fdf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924458, "uuid": "be9cd938-4471-4cb7-8cf1-2e288d9cd4a7", "value": "12288:C5dPG2fJkoW0C2q7f5MU2WZjC+mHgHOVXpXUznPxaSYRsgf+8O:qJbvCqUdW1oOnXYnPxaS9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687924458, "uuid": "32db266d-4e3d-4f38-8fca-8900b3f59fd5", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687924458, "uuid": "8624f00a-0985-4ec7-8664-a2b6bc428cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924458, "uuid": "b2ff840b-ae20-42d6-9ee5-1d7e4c81d6b6", "value": "d884898752a809e39203f30207e8b0c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6096298-157d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687934043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934043, "uuid": "f71ed3d7-0c8c-46db-a8de-8b5037a101ab", "comment": "Malware payload (GCleaner)", "value": "ec0d920855372275394954ffa6b07136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934043, "uuid": "484f475f-58b3-410e-9995-701d31eada79", "comment": "Malware payload (GCleaner)", "value": "0940206b6035dce4d1899cdd7bec4517d09d30c54b0216357d1d3fe61f1178b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934043, "uuid": "ee5fcef6-1637-4de3-aeb1-fc3328e5266e", "comment": "Malware payload (GCleaner)", "value": "3b3600c956b3fe3de980a8302baebb671b99e956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934043, "uuid": "973af739-f410-453e-8ed8-9fa944e99f5f", "comment": "Malware payload (GCleaner)", "value": "ffeb54a6d248b683f94bca88895625f97b6cdb3954b2e195c29adf3bffef5e2baa497ffcbd966af6687b6b7dbb3b9511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934043, "uuid": "5ae55e94-bb69-403b-9fe5-368ec308f9cd", "value": "T1F1845C3392B13D60E9254B32CE2EC6E83F5FF6528E6D77662118AA6F05B11B2C173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934043, "uuid": "505ae82b-9c79-4dc9-af33-b59f3198eeec", "value": "435e7ef59b3c6347cf62e2c58eef72c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934043, "uuid": "67e36d7b-7490-47bf-b06d-df776a803de6", "value": "6144:QMfx/WXf2QEoxczyNNPGacwNMYpJ6ey7:QQeXfUoxcGHP9cwN7ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934043, "uuid": "72e083da-c150-4ef5-9841-0b9646bc98a6", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934043, "uuid": "3280cb13-8b50-414f-867c-bc427ecaa4c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934043, "uuid": "7418a85b-d702-403d-8f52-1ba04278d572", "value": "ec0d920855372275394954ffa6b07136.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4715cb28-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687935548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935548, "uuid": "aa971140-12f0-4f38-9ae2-401028a3b930", "comment": "Malware payload", "value": "3f06247eb6e2f3fdd3da7bf4848fcaab", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935548, "uuid": "d801a637-1038-4d26-a219-d3d22739cf2f", "comment": "Malware payload", "value": "0a0b82b9c30f13d6cf38047aef70fd766780ecbe8fd7322db2c72823ed5e768c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935548, "uuid": "3d481080-f1e6-4b2f-ad9f-8fa3247cdda2", "comment": "Malware payload", "value": "15fd928dabd8577e88df8877ca62cfb38767d176", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935548, "uuid": "98d72ff5-84d2-4af9-aa46-15e3ffc3f1ee", "comment": "Malware payload", "value": "7f635eb41f8a1a91e43c5d85307d988effa1ba2de4538f11277c1fef225523bd21adcfde0f67bf661d62030a1916d634", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935548, "uuid": "8f9f464d-bbec-4558-874f-c28dc9000c8d", "value": "T1CFD18D1FFE063A89E650817EF8400EC6A52B36CF242D9956F4D0AB3271D7AC0652F292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935548, "uuid": "658f6283-c439-40fe-9bba-8703333d8f22", "value": "96:9sFneyVAmqFr+fifmgVotsCfvA/417AV0R7I9xUUOtCaZrshHOt:9kneyqmqFr+a++ITgY7V5HfCCQJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935548, "uuid": "5173783e-a269-4830-bcd9-b46f01e9e9a7", "value": 6221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935548, "uuid": "c862163e-d1cf-4e97-b4b2-6e6c0ce21e00", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935548, "uuid": "cc80f0fc-8e76-48ba-b61d-614f3647f4b5", "value": "Braemar MTM Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16145ac2-15fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687987435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987435, "uuid": "776ad173-3e32-4340-a280-821715da8cfe", "comment": "Malware payload (AgentTesla)", "value": "90efc8ec71fa28bb7fd3d423238f6ff0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987435, "uuid": "5be8d584-e6e8-47c1-a9f7-c0bcca0a65d2", "comment": "Malware payload (AgentTesla)", "value": "0c64b59284544f5b6999190a45541c39fb90eedb648a28825d02e06b939055ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987435, "uuid": "ab1feedd-8a1a-41cb-9f92-83cc8ce5e61d", "comment": "Malware payload (AgentTesla)", "value": "ac2799c0583f1cc9d1c4672c2a4577b81e0a80f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987435, "uuid": "aaf9cb88-e699-4291-8cd9-2f621f7e7c42", "comment": "Malware payload (AgentTesla)", "value": "2416f2eb36238f4e573eafeb6370b72c87d36974556ebfc83308d4ce9fd002302d5b10efe2a02b61ee95853febbd3b9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987435, "uuid": "f3210bcb-9bea-4d3f-9f41-9c90dfe9e5b7", "value": "T1689633584F94F7DEE7B19D3625F5120AABD971638A97CE9FCEC836200021BC8EB2554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987435, "uuid": "650fd864-f464-4ba7-9e77-156ef6b192c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987435, "uuid": "353f95b3-9f47-42c7-b768-e3b9a7c78499", "value": "196608:RhTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mT:fTb9epDz4MZZ4RmxYDiScfhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987435, "uuid": "5afb5117-6bcd-43b1-96e5-d1a0c1b14818", "value": 8648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987435, "uuid": "fef67d85-da4f-45d5-8619-7705280a9551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987435, "uuid": "360d6194-b741-4629-a563-a779a0122ef4", "value": "seee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef6b0b4-157d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687934138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934138, "uuid": "fd23b00b-dcb7-417e-b394-c17cd4198f9a", "comment": "Malware payload (GCleaner)", "value": "b0d18989b5bdfb438cae862119604315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934138, "uuid": "1a17f61c-ca92-4413-9e66-f2938e161b14", "comment": "Malware payload (GCleaner)", "value": "0d1d5b6cc87361d5e572f4911d926e8072c72653f0e5ecf6f05ca1fb9e7aca34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934138, "uuid": "3dd4b5fb-dfb0-4cab-8264-892db329692b", "comment": "Malware payload (GCleaner)", "value": "9dccf5bf64328a3e7a3bef933bb7893bfcbbe7d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934138, "uuid": "548f1697-e8ce-4423-92c6-19ac0245e3d1", "comment": "Malware payload (GCleaner)", "value": "7337dab66e614235c6f20e2b7d56c2716da2d0ba2650833a2a20de72d509dd9caf5a1d774b64230117cdebb0a72ecbac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934138, "uuid": "6a3ccc32-de5a-4a1a-a69d-1f806da749e7", "value": "T13B74BF13A2F17C60D5264B728E2EC6E83A5FFB608E5D375623186AAF09B11F1C273751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934138, "uuid": "8571349c-dbd0-4dd0-bd16-71796f54400d", "value": "4cb73e7166b3b7d1d1133e9f0d5a861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934138, "uuid": "44704d2c-fb02-4deb-ad19-7648a10328f9", "value": "6144:dqKxJ0Hw7Mhm+yGyeep/cfyV6/U9oK9UEIsnVzL3yEq:dTiHw745yGkUQ9ojOzTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934138, "uuid": "071dad14-e259-4680-8725-b14c66b18e8a", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934138, "uuid": "8a9cee08-1d3c-4d97-bd9c-12c06088581f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934138, "uuid": "019c4b39-ebb9-4085-b3ec-55757e9431d5", "value": "b0d18989b5bdfb438cae862119604315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5a2c49-1606-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687992572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687992572, "uuid": "08e57cd8-4248-469a-9f77-cae55da29f05", "comment": "Malware payload (AveMariaRAT)", "value": "eaef6728e58d9968548011a9523ebd76", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687992572, "uuid": "b6250a33-5fdf-4884-af5b-030e50c54745", "comment": "Malware payload (AveMariaRAT)", "value": "0db1623441ecf9e600d01c74b3ba5fbd9106ef366c59ffa12994adf293b60e31", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687992572, "uuid": "cc5d5bc2-e131-443d-b179-088f7940fca2", "comment": "Malware payload (AveMariaRAT)", "value": "d8620efb666b86ac9d7a512b1c2c23b89bf73610", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687992572, "uuid": "62fb469c-a51e-4867-8507-007f8fc64426", "comment": "Malware payload (AveMariaRAT)", "value": "09dfb462341fc626f00fa35937888ca7053c8bbaa47e043e1e39a3d7aa18e95ae38e6dbc6d7948ab875888f3c39b2810", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687992572, "uuid": "558db6c6-13ab-4ce9-b496-eb150adb2547", "value": "T110459E13F7E54835F3B201B01AB97E69CBADF9701268849FB39C858A1F31946DA21397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687992572, "uuid": "1ae6d288-22b2-41a5-9a6b-15bea826a580", "value": "1536:w0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:z1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687992572, "uuid": "c21b0d42-c6cc-4956-beab-9200e5157759", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687992572, "uuid": "53bbe420-4f2a-4790-8b49-16d8c0185882", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687992572, "uuid": "98cbcc61-83ad-42dd-a833-1a779bd3513e", "value": "0db1623441ecf9e600d01c74b3ba5fbd9106ef366c59ffa12994adf293b60e31.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ee701b-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687961990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961990, "uuid": "be0cd299-4ace-425b-a8d2-3edd110b34b7", "comment": "Malware payload", "value": "94668ac17f36548e1449f2114e09c5a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961990, "uuid": "a1e96e77-96f4-4dd7-a83f-77f54b58ab24", "comment": "Malware payload", "value": "0ffefe2d77fdd37e8dff23d4187ee4ad1c6f4d506d3178c6db673966599e9449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961990, "uuid": "d462e95c-81ea-4df5-a1b9-bc22bb648d3d", "comment": "Malware payload", "value": "b43a07f2b32d263d3f6fd106c642867ec9472fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961990, "uuid": "8276e1e1-d098-4350-a021-05c72c0e9187", "comment": "Malware payload", "value": "854efda999fa1fcc9a7b94d727387b65e15038cf85699818f244e230264bde7aa174b24b2c464f18c55b2703f43ebe5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961990, "uuid": "b23501e0-b16d-415c-8c8b-3d174a869038", "value": "T106F40102BEC295B2D0621D335B756B20693CBE201F65CEEFA3D46A5DCE215C0DB357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961990, "uuid": "1faf805c-cff8-418d-8714-114045aaeca0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961990, "uuid": "b3913306-58c7-455f-8f15-32693516ae92", "value": "12288:2ToPWBv/cpGrU3yVtX+t4VXcJApapQojU46Ea6zj9ikIM7KcqNlV/AD7:2TbBv5rUyXVXcJApapb36Ea6zjckIMyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961990, "uuid": "66fe9e2f-ec82-4929-ba67-2259f6e32375", "value": 724695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961990, "uuid": "00f3ec7b-d346-4e01-96d2-c8bbe8d91235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961990, "uuid": "f6e42594-91f6-492b-9bd4-06d1cb869dcd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dd61e0-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687961878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961878, "uuid": "efc5dc02-2334-46c9-93bf-b289df281e2b", "comment": "Malware payload", "value": "668ad90567977ff58c1bca5f5bde92f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961878, "uuid": "30943c10-e79e-44ea-b4f2-0d65c5155cd5", "comment": "Malware payload", "value": "1201be819db6d09ce9bd23656c5bbd7430e0420f30c39afe37b3a4662581f143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961878, "uuid": "5aeaf400-50e7-4c7f-af36-16f47807bc43", "comment": "Malware payload", "value": "6c45d0c531b0ebc8d224e839821bff1ec93cf269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961878, "uuid": "32d85fc3-13af-44f1-9f6c-17f8ea820323", "comment": "Malware payload", "value": "da66df57c5950de61f0a7fc0bc7f170be038ade59581ada639730ee291877cd6a4293afc335dd0d1d2357ef094522e31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961878, "uuid": "14e1a811-8d2e-4264-bc91-aecff234a85e", "value": "T11C84D0D8BF6ABAC1DB4CC479F0B5B42C03609527022AD76B265101F16D8FB49E32679F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961878, "uuid": "8849f53e-d2fb-46bf-8af7-c54a22241b7d", "value": "6144:7AmPuLAbAkYWRDFqz64MThoIIkOhW9mJxRcomeIDJ5V45gfFXEAobU:7hiAvYkkW4MmII1ZBmvJn00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961878, "uuid": "baa7a952-5023-46f6-889a-b5958d2b39e9", "value": 387088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961878, "uuid": "374efbc1-d3dd-4d5b-9116-dfb35b76c22b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961878, "uuid": "b831609e-3208-4b97-b279-1c3b889fbce3", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80affd10-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687935644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935644, "uuid": "fcd1f2bc-f902-41f1-8db9-28cb431d4261", "comment": "Malware payload (Mirai)", "value": "8df6356b9a99e2327b225b2d63c6d993", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935644, "uuid": "75cc5b18-e6f7-4f93-99f8-efae1665c8a1", "comment": "Malware payload (Mirai)", "value": "12e0cf7bf9fdbe1657c3afa7e7dec0e2de83e71d82471e6d595ef0b73873577c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935644, "uuid": "da2ef251-b22c-4f8e-8c9e-e336660054e4", "comment": "Malware payload (Mirai)", "value": "5bf5d621a1dc843879ae628f08fa876ae1431368", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935644, "uuid": "f7596643-f122-496f-ac2a-a22a06d2c302", "comment": "Malware payload (Mirai)", "value": "01325f765b684aec6a832a61baab55ddb757e965df1e7877b297634dafe49d9ff31c4831353b4c1f127315aacacf0927", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935644, "uuid": "34249b11-1eb3-4fe5-80f1-4df439b3fb9b", "value": "T1EA33940ABF610EF7EC2FDD3745B81B45348C641A22A97F75A974C828FA1650F46E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935644, "uuid": "71ae6119-2b2e-4ce5-aea8-2602410ae0fe", "value": "768:nP843rFZLyPA+3Q3j4UC2UzglmexqeCue6XnMZnOgkXi7s6oxP:nP843rFZ2p3Q3MURG0qDuJXMZnOis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935644, "uuid": "4f2f6363-078b-4152-bff7-ba2d29b32dce", "value": 51176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935644, "uuid": "2cd1301e-5cff-4e78-b3d9-4f3aaf6853ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935644, "uuid": "6e54ffce-51ee-4032-a7e0-dd6fefea366f", "value": "8df6356b9a99e2327b225b2d63c6d993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4ca2aa-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687935640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935640, "uuid": "4ed76cf5-1c3d-42d4-a851-c4ab71b6dc02", "comment": "Malware payload (AgentTesla)", "value": "702afdca8f01b2e8cca517d70c86afb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935640, "uuid": "27053eca-fafe-48ca-8b0c-ec34f2b07297", "comment": "Malware payload (AgentTesla)", "value": "1351a38f4fda98fab7739eb2ed12b41e247dae14f11734395fd159c39b085fbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935640, "uuid": "3d3ec383-9748-4b1d-ba78-0b47b71e7b89", "comment": "Malware payload (AgentTesla)", "value": "44bf11c6921fdff23ba588b24a1aa2b4d57501d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935640, "uuid": "7ca12351-5348-4943-b71d-89ded31eb724", "comment": "Malware payload (AgentTesla)", "value": "2c87e6604385cfed5339218d90f5522b46299a8d8f63da0d4382dc95bc0bce8c05e6179a4f118d2802b4bedafff496c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935640, "uuid": "92cfbd35-29ab-490e-94d6-caf194d4f3dd", "value": "T1E9C4693C1CBE2A37C135E6A9CFE48463F550D53F39219936A8D797958306EA221C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935640, "uuid": "2e811eff-9b37-4515-b2c7-71e0244f9dcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935640, "uuid": "e95e03ec-6fb5-495f-b21b-123b46dafd65", "value": "12288:6qrM8126rYGidOI+bcbICwlMnPfqttKcI0vUM90r3VWb2gm:dMUrYGi3+QbICwunPfqttKcfvUM9K7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935640, "uuid": "8728f032-5d39-4725-aedf-53ded83f5927", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935640, "uuid": "02638c4f-b106-4db3-b6f4-1db8f87f0227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935640, "uuid": "710adc36-685e-475e-aa3a-37936775ee44", "value": "702afdca8f01b2e8cca517d70c86afb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd57081-15b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687958212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687958212, "uuid": "ec3fcfa8-c9f2-438f-81b9-f1bf4bb8637d", "comment": "Malware payload (Smoke Loader)", "value": "7fcb8e4140a672543ebe5ad80624463b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687958212, "uuid": "108080e8-c587-4fb9-b0c0-791a4a7626a6", "comment": "Malware payload (Smoke Loader)", "value": "13a43acaf411468a1ddfa5f221464f0ead5221a8694bb1027273206ecfa2e336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687958212, "uuid": "78491e4f-fe04-4903-974a-e5887541dca5", "comment": "Malware payload (Smoke Loader)", "value": "cda11091b4c049bbd834fd9411567f2d3407ae92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687958212, "uuid": "998542bd-3a71-4be1-8fb2-30f48b6a62e7", "comment": "Malware payload (Smoke Loader)", "value": "c6f9c2d8f96971caf7dc2bc9646d4bda8b930bc655c041a4e3f682bf7a5d9c474107bf57063dce0848166d4c85b2d1d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687958212, "uuid": "6f4f6c76-9d3b-4bed-9eb2-c031a973e129", "value": "T16164093392B17C50E5268B32DE1EC6E87F5EF6538F5977A622189A6F05B01B2C273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687958212, "uuid": "1691ee1a-64e6-40aa-85c9-8f005e243376", "value": "bf2fa62dfdc43c5588f7d5224cb9e043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687958212, "uuid": "108db5e4-8c0d-4c11-846a-c24b63d73873", "value": "3072:0KVlHRxm2zum769pbIcJrRAthu9ezs2NXa01ETSefwbZnrRO2/uFuRKx:/HfV/769pbDRAtyosjEnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687958212, "uuid": "848768c8-2c93-44e0-9dd6-506618b1b788", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687958212, "uuid": "8f9a079a-a47a-43a1-aeb2-0acc87d18fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687958212, "uuid": "f87dca91-6a72-4255-94f8-e477aadd3ca6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8582e437-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687933076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933076, "uuid": "54267dde-1cfb-4e0c-a2b7-0dca97dc1db3", "comment": "Malware payload (SnakeKeylogger)", "value": "a54c4e5471437f2fc522b2408ca85199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933076, "uuid": "6967f186-e232-40f1-a6fa-943b59cb81dc", "comment": "Malware payload (SnakeKeylogger)", "value": "1477028011f4eee90aee12343dba45894cda5ef752e65f054373dd4f0041b863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933076, "uuid": "24eb6fc0-5e9d-4b49-94e9-8c8d60522dd1", "comment": "Malware payload (SnakeKeylogger)", "value": "f31f4c6a1e900bacafd5192e2e799e60611e6318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933076, "uuid": "61dbf667-c1c7-4598-a303-24f9a5b64d1f", "comment": "Malware payload (SnakeKeylogger)", "value": "d3bcc8ded982bd6eddfa9900d19be64932738a7f9aecc5207a1cb1b0c87b3ccdebbb7d22264ec3b0dc9f12edbc6523c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933076, "uuid": "a232a7f8-f4e6-4843-8710-645a0c95c80e", "value": "T1CDD3181D6BF8D800E5FF4A7705B16112C776FC62092ACE0D06D2F55A2A7DA908D1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933076, "uuid": "c9cb8378-fa9c-4010-b2ef-4e7f50d76e1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933076, "uuid": "35bb87ec-3edb-4474-bae2-6c3a71615490", "value": "3072:rw1/isBuIxj6W7jPPY9b7IKvhBvwBPNogbY:Kiwu2bIbkK+Nxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933076, "uuid": "4136eb9f-47f3-414a-bf77-15ab83aaed23", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933076, "uuid": "0f0fabaa-67c6-47f6-9e24-344abef4a65e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933076, "uuid": "0294466c-da23-4910-ada7-8124e1aab61d", "value": "a54c4e5471437f2fc522b2408ca85199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6debecbe-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687987153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987153, "uuid": "02193904-148c-426e-a2c1-5b452d1273c7", "comment": "Malware payload (AgentTesla)", "value": "7b79bbfe338448b0de666215060d2cbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987153, "uuid": "2507dfe1-93de-435b-bbda-ab8ba2439345", "comment": "Malware payload (AgentTesla)", "value": "150169f8a2862e4c977fe99b4d6a1af4e2169deae6d76d64434af35633c01e03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987153, "uuid": "d21c4209-7d03-400c-80d2-5776cb924a75", "comment": "Malware payload (AgentTesla)", "value": "d8ca513e1e85e1a8dd6a81824f86064fad19419a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987153, "uuid": "2ca3bd10-5b6c-46b3-8f20-c9366663cb67", "comment": "Malware payload (AgentTesla)", "value": "ef1a98cf6e7406bad78e19f4b284b6106b153b7ed0dab10670b59735df85a371623dfa1fecee741d0d988f48a7d7200f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987153, "uuid": "db77f3d0-c207-455e-b7f1-710929ce5024", "value": "T163C6332C4E98BBEEE7A15D7922F20529E7D97513CA57EBDFCEC8365001227C4EB19084", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987153, "uuid": "cb1842eb-84d1-48ef-a690-a837f8f65564", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987153, "uuid": "233ae060-337f-4df4-9607-0687fbd01f8c", "value": "196608:ChTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mT+uFk8spbVgo87e8YU:sTb9epDz4MZZ4RmxYDiScfhHjeV+vK8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987153, "uuid": "73cbd627-8d13-4db3-a520-6ec5d9dc8b8a", "value": 11867648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987153, "uuid": "706befb0-c3e8-4703-bc6b-61563cb492d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987153, "uuid": "044a0731-20bb-4851-bf75-64aba07b8856", "value": "fuckme55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362c550a-15f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687986200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986200, "uuid": "b51a73a3-b179-49a6-a2c3-9408f3c166fe", "comment": "Malware payload", "value": "d0026406da049ad2a1ae9b202db6f2b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986200, "uuid": "d9e61242-9c28-4924-9042-8b770dd706b1", "comment": "Malware payload", "value": "15c4649f1914b4c191e8e4e17a7ea409a95b21647485475f5d5c3368586165b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986200, "uuid": "7bc2a727-4248-461c-87c5-c389356f557f", "comment": "Malware payload", "value": "430e033c10b512d05c7a85ae84cdb065dcadb048", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986200, "uuid": "07a173e1-fea5-4053-9488-e99a1ad812ae", "comment": "Malware payload", "value": "d3bc7c91f0a7cf964d1b48a8229f430b618c841fc356877b618c0fd8d55bea04a4cb09edcb66421a7e6f9250deb406a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986200, "uuid": "f32e04f1-09cf-4113-8204-b11a75aa2fea", "value": "T1F531C4A05603D55F13CA88036E0B7EDC206EE17BC5C92206B4A5670E749AEBBCCD4FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986200, "uuid": "dbf80c0b-abee-4f9e-a3f5-42106b395e46", "value": "48:adTjvQ41kzh3Qb8v97dYMIODYhvrAn/C0Ls:adg4izh3d2zhvSDLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687986200, "uuid": "205705e8-114e-42dd-a827-acf0a24522e0", "value": 1711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687986200, "uuid": "7abb36e8-30c9-42ca-bd45-4d8203b05217", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986200, "uuid": "a39ecfc7-1010-426a-acea-cbc70eaa58c2", "value": "payload.c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ecdaa1-157a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687932507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932507, "uuid": "a8added0-2267-40c2-98df-57c9a339c816", "comment": "Malware payload (Formbook)", "value": "6a4d531095c70f0e45a6b9cc33be39d0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932507, "uuid": "9d1a1c64-797c-4373-82f6-25b10dc2d3fe", "comment": "Malware payload (Formbook)", "value": "165b8d6325abf101bbdb36a6c67920679ec28b6fab20c5a26d60f11787aae618", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932507, "uuid": "20cd9059-34c7-414b-a726-4a879f1e46e0", "comment": "Malware payload (Formbook)", "value": "37a1233922f70487034c1609f2921485c29aac00", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932507, "uuid": "6c939837-afdf-4a46-bf2f-bb4bac51e6aa", "comment": "Malware payload (Formbook)", "value": "e189ba7d362907e131871262cd964d318cf82a5f89629124550cc45f7b1da1f19534741ad657332858421adb3093c121", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932507, "uuid": "e52233b3-9313-4602-bb1c-15009937a3c2", "value": "T14003905AE78F02A58F9112B7131B0E8996BDB23EB35055B134AC933433EDC3D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932507, "uuid": "6e6b94fe-556f-4b8e-bdd6-af10f8cfcc0f", "value": "768:MFx0XaIsnPRIa4fwJMhcivHY5FIJYws1bgaxAT8smynlyc:Mf0Xvx3EML/qws1bgaxAIrcll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687932507, "uuid": "232e7b12-9903-4ee7-8805-5571b842b7b9", "value": 40570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687932507, "uuid": "5f8f5383-00ff-45a7-b630-f874ed01cb53", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932507, "uuid": "c388a071-5c25-458f-85c7-686c8ee708d3", "value": "6a4d531095c70f0e45a6b9cc33be39d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925c69eb-15f1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687983778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983778, "uuid": "7c292f32-a6a7-4b77-b422-3690f58127b2", "comment": "Malware payload (Fabookie)", "value": "912b005e323c1fea5f194bb3a75164db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983778, "uuid": "c44ba175-ca82-4081-9557-d29ab7408a9f", "comment": "Malware payload (Fabookie)", "value": "172c676aad88fff72547aca0af781610bc968d2d60dab00d7d76319d5d53bf53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983778, "uuid": "d5373a84-5e89-40af-b790-905202d2d536", "comment": "Malware payload (Fabookie)", "value": "5afae053b0c4fedfca67fffd76c307ea83d54ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983778, "uuid": "27e8ea9c-e073-4373-acf6-7152ce4a9c64", "comment": "Malware payload (Fabookie)", "value": "34d4f986f3c02a64a45a745924d2421454f0aefd55974707f278d6be145d09d3b8724b607d5c0a6c010058585c6ca225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983778, "uuid": "c01e412e-8454-4a02-b434-05d3173c324f", "value": "T11C644B4392E17C91E926CB729E1FC6F8771EF6508F497B652238AF2F04B11B2D263611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983778, "uuid": "bc3fb5a5-5ff2-42f1-8db2-2ce68d7940e9", "value": "35c652ec2d2e6b7b1a97d833dcfa5b29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983778, "uuid": "d35e8dde-a692-4957-804e-7e9a02f31864", "value": "3072:dlSVA2QFiighAwN+9wbiUg3uLWCLj5Py/r:SVlQFiiaFsuXxy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687983778, "uuid": "3893729d-c1b6-421e-9dfa-7280ac391eb4", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687983778, "uuid": "c4eac451-a87a-4315-8371-20947e174068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983778, "uuid": "53123712-9e5a-481f-8b7b-7253462bbac1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9940ae23-159a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687946423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946423, "uuid": "001dbab4-106e-46e9-b837-ec572f2219a6", "comment": "Malware payload (Loki)", "value": "7af482560b8e161cc8e47a688d31f2c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946423, "uuid": "2503cce4-b0bf-4edb-a9e6-f5253cd98538", "comment": "Malware payload (Loki)", "value": "176d0911e9479d61aa6fc3967ffb60e1884c53711cf6f63d92647bc4ad0082dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946423, "uuid": "cfc2c2b5-57af-4571-b494-1e779ca8c1e9", "comment": "Malware payload (Loki)", "value": "ee814b16fd6004fc8853eca3a41f9f87764658e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946423, "uuid": "79fa8326-f423-447b-bafb-d7ea8428581c", "comment": "Malware payload (Loki)", "value": "010cba71b4085342ad271870698a2a2e5cac53d97e155f3048c73eaea7e3b9294ccf9713243c6fb243f741797af74b97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946423, "uuid": "205b4b97-0cd8-4d90-a866-a002e2198446", "value": "T1E615D0507259AF60E4BE8BF60960427157F62E6BB43DFA094EC7B2DE25B0F018961F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946423, "uuid": "a5c7783d-7a8f-460c-9a25-603d106a199e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946423, "uuid": "7f6b991d-e2de-434c-9d1d-af3aaad5b790", "value": "24576:D7MyuyF1/2T/wJ1KNo7xt92T3UcBN6mt:D7MyuyTmoJ1KNo7wT3Uc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687946423, "uuid": "ff4b076e-414b-422a-a7a1-7932ade33366", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687946423, "uuid": "791ecdb7-1628-48c5-9e54-b83ff118074b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946423, "uuid": "167547d7-acc6-4e68-89bf-8d9cf4031891", "value": "rOrderPONo00066904900118080June282023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180b6755-15bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962098, "uuid": "e9018c1d-2146-44fa-b1ad-0a0c934caf11", "comment": "Malware payload", "value": "8bad967fd45868db87f78fff208de960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962098, "uuid": "09b232fb-f523-40d5-a64d-07d79ab59bb6", "comment": "Malware payload", "value": "189b5ffdd32dfe63a11a824a05c063b3b1d543a0eebdb75475a7d4159842bef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962098, "uuid": "cca02001-d348-40aa-b80f-8f4647d3299f", "comment": "Malware payload", "value": "314955afb202e1e77d66e8c32d29c74787e95a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962098, "uuid": "ed4252f1-cd6c-4f08-b3ad-79f0dbb4643c", "comment": "Malware payload", "value": "b20fbeed9eb82af38efa8c4f5a2008c9eb139cc689491eefb64ebbc0a2f388cbd32636ed83112a241b7e5c6b6202c9ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962098, "uuid": "2ec73d2a-4da8-44e2-890d-248b7d5886dc", "value": "T167E48DB84540799BCA782A31DB19FF9E30EF138920FB8A533D61D4BB0759072678D693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962098, "uuid": "06ee1f9e-12d1-4852-b786-389773c22b3f", "value": "12288:1BMX8XvEYnFn0eTeURtkAhYjoivp1tf+GsjmzSNn61wsOpFgt+7:1BY8/Ek0eftkRoGf+tjj6w2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962098, "uuid": "df407af3-f842-43ee-8577-a4bba056a556", "value": 692240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962098, "uuid": "94873e36-4360-43dd-bb3b-b1fd916861c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962098, "uuid": "cd403156-87b3-4240-a5ef-0a01a2ab2f27", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5856bed7-15f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687984110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984110, "uuid": "ba29569b-ec3b-48ff-8cad-80a73bf2531c", "comment": "Malware payload (RedLineStealer)", "value": "cc087798b3f8c238bf6bc20c38467816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984110, "uuid": "2d7ae21b-ad05-4221-9e9d-b9751a47f430", "comment": "Malware payload (RedLineStealer)", "value": "192b377c2d1bb8549b1d2e1c3adb3b21f838fb60a6c0193720191f3cbbc065ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984110, "uuid": "9de2e834-29f9-45f1-92b6-5ebb3bb23b88", "comment": "Malware payload (RedLineStealer)", "value": "528188228d043e79f9da653db5d0c2a21d5f97ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984110, "uuid": "0391ef41-3fb1-4458-bb52-06a293b91a05", "comment": "Malware payload (RedLineStealer)", "value": "7bf63af3a347cfb6db24fcbc758a0a54aaba3508741402bf96ea66d255de2343dae263e471965a530c00a60df4afe81d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984110, "uuid": "4d118ebd-d151-4dbf-a1c0-f2a479b465b8", "value": "T192847C4382A17C50E926CB729E1FE6E8775EF6608E59776622389F2F04B11F2D273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984110, "uuid": "f9b9887a-cdd4-452c-86b6-71a20528818e", "value": "35c652ec2d2e6b7b1a97d833dcfa5b29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984110, "uuid": "720512f1-6a34-4464-a8bd-58f8bae6ead5", "value": "6144:nXEKCToiSs/UBIRWr96SoKyIErspLUzh8isVlQd:XEKQkUSIwr9R1VWh8Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687984110, "uuid": "e1e04b60-c9ff-43e0-94bf-cb2d502ebdd1", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687984110, "uuid": "24bab4f6-4053-4101-a7f5-8e17df918803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984110, "uuid": "a4b32ce9-576b-48ac-942d-470263d10f7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9664d1b-155b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687919472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687919472, "uuid": "c586763a-7da1-4f82-9f58-a7868fbe2f3c", "comment": "Malware payload (AgentTesla)", "value": "1a9b06437a3571135260921c5a904c84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687919472, "uuid": "3e3d03a9-f4e8-4c17-9068-1420588c0607", "comment": "Malware payload (AgentTesla)", "value": "195306e2bee1f209566b224cc483adaf4431a74851f8138fb1472c84af3b4cc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687919472, "uuid": "13bbd6fc-0da1-4ee0-b570-fc379d098d27", "comment": "Malware payload (AgentTesla)", "value": "6ba1d1e14896b8a91749dbe8e4d84689fbef98bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687919472, "uuid": "3108da3a-5b49-4ec3-b596-bfc224ccdca6", "comment": "Malware payload (AgentTesla)", "value": "c9f6912e54e73342caa6c1c18ab94e72410a64d2d98aef1a35199c6f28e9a1a90f917af327a89face953b211ad78a5a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687919472, "uuid": "944e34ae-8eab-41b7-80b0-a4ce983c1961", "value": "T1F2E47A3C1CBD2A37C135D6B98FE584A3F454C43B39229936A8D797A54746EA321C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687919472, "uuid": "8a0bbe12-739c-4143-9410-c38e9cef97f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687919472, "uuid": "820cbddf-8e42-4343-80b7-fbbffef5fae4", "value": "12288:9P3WF9dtHElHWSAlfqWysRHCynETPEMIAdj9fU0mYuWgBG/b:9PETtkFWDlfMwhnETB+0mfBG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687919472, "uuid": "a65b0da4-581f-4948-a3e1-4519bc9e7481", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687919472, "uuid": "d1bac3ae-d321-4ea6-a669-067f7749f7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687919472, "uuid": "374001ea-95bc-4bc3-a503-aa6cfde8cb7c", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.30347.20970.16617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe1e9b0-15dc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687974754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687974754, "uuid": "1ac975e2-f203-4f65-af56-355a68cf56ad", "comment": "Malware payload (AgentTesla)", "value": "08a928481a037e7eb89fb27d251983b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687974754, "uuid": "34b20dad-e0be-4eee-b8f0-99b38bf24476", "comment": "Malware payload (AgentTesla)", "value": "1a440b94a68e98bea79401ae8aed0c35b86f9f713803f45431ff587edcf5bac8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687974754, "uuid": "97a7130a-4650-42a3-bd0a-e0c5ec9c7562", "comment": "Malware payload (AgentTesla)", "value": "803ed6941c4f6cd7c6e61ac2aa772ad53bc9a54a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687974754, "uuid": "cbe0d5ad-cd16-4ce2-a1e1-81aa6fcabf91", "comment": "Malware payload (AgentTesla)", "value": "c1728f323f4e01a31d23a5cb99a4caaaea50fb212574de5fa9246de6ba4f05e7c2b8a7c6b0d2021b4fb2323a4ac3fd66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687974754, "uuid": "b00d87eb-c43e-4145-80ca-a8f98343a21d", "value": "T124A49A411E9F5008A663BE9F47EE74EA8F3B76351A39C569014E450B0BEBED1B850F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687974754, "uuid": "ee736264-6299-43e6-9d04-ebfec9733ac2", "value": "12288:bCOTh3v+Yjjjjj6jjjjjqjjjjjCjjjjj1:Zt323", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687974754, "uuid": "3106dc39-303c-42be-ab5f-56f9bfb67dd6", "value": 479346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687974754, "uuid": "418c7987-db1b-4afd-bdba-e44c80d5b6e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687974754, "uuid": "e3d8dbde-edd7-4f19-9d69-894ad3b1243f", "value": "jabvet.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519314c4-15bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687960906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960906, "uuid": "9ff69837-964d-4d03-94b8-e653c7468f52", "comment": "Malware payload (AgentTesla)", "value": "a218eda854cb00cf201029e2f574fcb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960906, "uuid": "11395c75-2d46-4642-b8d6-05bd827fc3ee", "comment": "Malware payload (AgentTesla)", "value": "1b6b62b3f96553b8800f1c2c38ef1dde521a149715534f1fa19d02a9df8722bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960906, "uuid": "211b53d8-5717-4393-92ae-4a7801b85680", "comment": "Malware payload (AgentTesla)", "value": "fffba41e035c8d9d41446caaeec0f9956c1ad048", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960906, "uuid": "74006d6c-a617-4ec7-96a3-de7329d7406c", "comment": "Malware payload (AgentTesla)", "value": "05e6044654e10c14f4465ef1b89ccfbfac6cc2aee9184b330b95d9b781c79f65a58e5503d8a734f843c8a729f53c52ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960906, "uuid": "16fb6ba7-6fa2-42c1-b943-515e2a23fc52", "value": "T1650538227B7A4F81C2D6ED7EF14E95D033E8E8D71360AAC62BB47CF192A75C11E1A504", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960906, "uuid": "f0b7b56c-253c-402d-8a44-5a41ec47877b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960906, "uuid": "e15631a5-b613-4c84-a2d4-eb727d577645", "value": "12288:Zqtlu96FG24mhC79JIc9gJYJcmuf4vcfKKGqCO:jBQC7L82U4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687960906, "uuid": "d8a0963d-b8da-4934-b2eb-8208e0c0352e", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687960906, "uuid": "d7593809-fd7d-42bd-b260-182551ac3a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960906, "uuid": "42144a96-4437-42b3-b71e-47b2dfaacc87", "value": "Inquiry Specification-2806023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1177e0-15c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687963690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963690, "uuid": "bd328f4e-2166-4f93-a239-beed118c0dfa", "comment": "Malware payload (AgentTesla)", "value": "1f2c6935c61d49280d0045b8f2116825", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963690, "uuid": "0465c4ee-e0f5-4be6-9fd8-a0c0ac134002", "comment": "Malware payload (AgentTesla)", "value": "1d0cf9a5e034371075cf0a328d98c53f4eeb74325d61ee956222346ebb1f5497", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963690, "uuid": "b9ed28bb-ae32-4e39-a4f7-71e79f50a5c8", "comment": "Malware payload (AgentTesla)", "value": "4155b3ddc7594410c0bf44a47c1dabebd9139a77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963690, "uuid": "ab6eb0e1-549f-4801-9cde-9ed6502a8c78", "comment": "Malware payload (AgentTesla)", "value": "4110b12e037fe90ed8f1963f9aea30d0f9d83fe81bbe40b4037b7eb643a642d08e97ab25393b33fcc2f2129ea324e842", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963690, "uuid": "8dc71816-fc86-4f38-8444-6c31c2189495", "value": "T10EE4183C5B7D9A22C034C6B5CED584B3F2558F3AB411D922588A7BB56722B921DC333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963690, "uuid": "d00194cb-2cf5-40e3-b998-39a09d5bd033", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963690, "uuid": "43a031dd-b8e2-45ed-bb22-3e4d36e9d982", "value": "12288:Icj68OWbTgWhCLoj4+cv27SObVt0RaA0wndwFQPjXtYX3D+:NT7bTgWhCa4FaSwG10GEQX63D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963690, "uuid": "145ea583-3bd9-49ee-a20e-b0fcc8376612", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963690, "uuid": "ab493133-93dc-4e3c-9333-a39adc7c1150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963690, "uuid": "55cbd0d1-be3a-41a2-b01b-646bbb6c8678", "value": "1f2c6935c61d49280d0045b8f2116825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debb2755-15c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687963719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963719, "uuid": "9921a4bd-5f1b-4f6a-b85b-3a0052d6c8e6", "comment": "Malware payload (Rhadamanthys)", "value": "5a10bd1d30a2ac38cc92244116ecb4d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963719, "uuid": "30c08862-9228-478f-8d50-cf85479e8b19", "comment": "Malware payload (Rhadamanthys)", "value": "1eb7e20cc13f622bd6834ef333b8c44d22068263b68519a54adc99af5b1e6d34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963719, "uuid": "60a28539-a8f6-460f-b86b-661bb50d60fa", "comment": "Malware payload (Rhadamanthys)", "value": "b678afa5dca107cd5c2e9d0b12842083540470b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963719, "uuid": "440c7f4e-4eac-4b76-96cd-f2a354fb8d32", "comment": "Malware payload (Rhadamanthys)", "value": "2724f742c4af9896a81ddd4257b8bc544bfe4a83f43f5cbd9a1eeb873b3673730574348de1c5820016c98d721749c19d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963719, "uuid": "91e183d7-3767-4d28-9417-d3e418dc5bde", "value": "T14AA40211B981D0B2E4428539882EC2F5797EB8708B74DDC773F8277F6E312C15A7A2A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963719, "uuid": "c9341959-438e-4896-b7e9-099872203eed", "value": "f1d9ed365982f922b6db5c4cf987cb66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963719, "uuid": "44c7b45e-b034-4a0c-be97-be5ca08ae32b", "value": "6144:A8dbpU7ZEkmPhAcxMyOLspFeVqdTZhA8EwQUIuidFo+uXAg8mBcZ:XddPhAcxMyOLspFewZFVridq+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963719, "uuid": "3c42ffc9-a4b2-4962-b87a-22b55870a173", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963719, "uuid": "e9b658a4-6416-415f-81d9-068862071fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963719, "uuid": "88a5691a-f080-4818-bb52-884f41c8cfa5", "value": "5a10bd1d30a2ac38cc92244116ecb4d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8004fe5f-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687933066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933066, "uuid": "4e86547e-9a48-4867-ac84-50113719e9b7", "comment": "Malware payload (SnakeKeylogger)", "value": "2b741bb6e76b250cbe07b426fffc17ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933066, "uuid": "6e862975-de11-4728-8990-42c944062db1", "comment": "Malware payload (SnakeKeylogger)", "value": "24024eb9d8d2f7b30c539043183037095d82179895b774900c408d5519e931c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933066, "uuid": "cba254bd-ca3c-4120-a875-dea2ad5b3e04", "comment": "Malware payload (SnakeKeylogger)", "value": "6ca94f7135c544293850bc2378f74f97f256e197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933066, "uuid": "fa92ab97-1674-4529-a3e6-1e401a1d5c52", "comment": "Malware payload (SnakeKeylogger)", "value": "e63426f813083fc22c9d5280d0442e30bb12556ddb3acf20dcafbb5e8f39fc37c4286101c2d665e07bb526c11495e0f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933066, "uuid": "7b4abcc4-48e2-4482-ab70-3af0f0ad2224", "value": "T151E4373D58FD6AE7C035D6B98FE5B463F410993B39224D226CD7A7544326AA220F323D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933066, "uuid": "981dd324-0447-45fc-ae12-3894f1e9f768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933066, "uuid": "43fbea6d-f0b4-43fb-bddc-c559e7c64898", "value": "12288:pl2iNTsAQgS4zPodsqM3pMApXRe+j5c9oljAr5:pl11TQX6odslMyBlj5XA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933066, "uuid": "bbec846a-d282-4e29-86bc-fa632214b349", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933066, "uuid": "964785f2-b5fc-4492-980a-42f7962a9699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933066, "uuid": "c0da9bd4-62e1-41e3-8a9a-042e67db5c09", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afc3df4-15c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687963955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963955, "uuid": "8d787321-6d1b-47c5-9479-fb0a065c8392", "comment": "Malware payload (AgentTesla)", "value": "9e075f19632321f1b9bd8e08c97ccc3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963955, "uuid": "506709a7-93e0-479b-b4d8-07a401c2ac23", "comment": "Malware payload (AgentTesla)", "value": "259f1fbe74a74d7a536397bde987a0531e5479827da769a22e125a1d6840103a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963955, "uuid": "9e7b7463-56d6-46ca-a581-3e957b59d626", "comment": "Malware payload (AgentTesla)", "value": "b1420fd6d9baf143d4fa844f41de635ed9f2e178", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963955, "uuid": "eb6ab933-8ab5-44fd-81fd-5db2b6078725", "comment": "Malware payload (AgentTesla)", "value": "1893583383fcdc1cd5ed461b8d2bda62838b53e41f338a11e54fa4bde09c4d5b937062512baece2b67ff46a10b1c014c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963955, "uuid": "75758298-a93c-49a5-8eca-e4c4cffad5b1", "value": "T102E4183C6B7D9A22C034C6B5CED584B3F2558F3AB411D522588A7BB56722B921DC333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963955, "uuid": "d1ceab5f-23c3-4b14-bae8-1e05d8eed25d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963955, "uuid": "79d54f05-908b-42bd-aafe-12702b3bc5ce", "value": "12288:Pcj6Zu2WvztDswCaXRj3CB8N/sFnCUsU8GnAh3jx7:UcuzrtZCaXFN0C1Gnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963955, "uuid": "5bdf088c-a868-492b-b3c7-f568c97da4d6", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963955, "uuid": "3f37b150-8e65-4e61-9a61-aaa86187e1a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963955, "uuid": "7df44d9d-00f9-43e6-9b4b-dc7d2158207a", "value": "9e075f19632321f1b9bd8e08c97ccc3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947ba2d2-15d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687973473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973473, "uuid": "eb5b3cd8-ae7b-4129-9cb9-72431762d6a5", "comment": "Malware payload", "value": "3ae441358fed96bcf34203a574247309", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973473, "uuid": "e713e7ea-1d28-473e-bceb-f83c756497ae", "comment": "Malware payload", "value": "2605912a85283ae0789368ad328e606ea0a05780555ca3f8dd40f2a9489943f6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973473, "uuid": "b4b19fda-40b8-4179-afec-d6a689b34573", "comment": "Malware payload", "value": "cf588c0940f598785b03be8fd2fd675f66c730e4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973473, "uuid": "da78adae-4ce0-40e0-8bc1-8c2a7f902a5c", "comment": "Malware payload", "value": "8838b15648b782ed68238bc48c57edc45336ef5a61560fac6c1c62591488996736a8ef5ec64a169ee6f6561713d3dd5b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973473, "uuid": "3e37a015-a733-4426-bd2f-d15999227074", "value": "T13A46F123BFDBC42DD96B687391C3A562642A51A8AD4B947F02D01985CE30C4B17D3FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973473, "uuid": "92e66231-061a-488e-b33b-ba87c04f264c", "value": "98304:lPyQSfOCgMSZvm5QeBARNzmZ036PmfjpLus9C/5EB6tPQz:d4fOlMSZCvivzzqPijpfs/5EBkYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687973473, "uuid": "8767c03a-1e25-4d88-bd0d-47df1db1932a", "value": 5735468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687973473, "uuid": "bc41c214-b60e-460c-9a24-b57d9b93aec0", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973473, "uuid": "62599fed-b105-46ed-a640-bc30239e1fc0", "value": "2605912a85283ae0789368ad328e606ea0a05780555ca3f8dd40f2a9489943f6.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a841b0aa-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687987250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987250, "uuid": "d15539fe-5a90-4463-a18e-6e083c46b4d5", "comment": "Malware payload (Formbook)", "value": "49821681a577c7aa118eca3400d71d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987250, "uuid": "51d017a6-2c82-42bb-8761-75a4257e18ec", "comment": "Malware payload (Formbook)", "value": "2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987250, "uuid": "25c018c5-5d46-48eb-84c3-2437f5230ac3", "comment": "Malware payload (Formbook)", "value": "e96ae5a5f90e3a4622b64e91d374bbbd102165d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987250, "uuid": "66f068a0-a546-4639-96f3-1bf5822cd609", "comment": "Malware payload (Formbook)", "value": "b62fab37568dbcfcc1a047476057d804a1ce59f5d75e980173c211b3c63a962aa95d82ce1345ce2c8ac7cb35959d232a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987250, "uuid": "28f6a91e-008d-4fbf-a00b-32621faaeb54", "value": "T14C9633584F94F7DEE7A19D3625F9120AABD975638B57CE9FCEC836200021BC8EB2544C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987250, "uuid": "bf4b77bc-1b37-4b97-a74d-4568436ac6a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987250, "uuid": "41329b6e-30a8-4137-b61c-f23bf85acb60", "value": "196608:ihTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mT:MTb9epDz4MZZ4RmxYDiScfhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987250, "uuid": "2dcaffac-fad7-42c2-a9f7-335be642baaa", "value": 8650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987250, "uuid": "68c31b1f-bafd-4da9-9055-984dff4c86ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987250, "uuid": "4b79502b-2454-4afb-93c4-1e453963a161", "value": "me2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e1a03f-159d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687947808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687947808, "uuid": "9b14b6ef-8859-4ce5-ad9b-628dcf9ba96c", "comment": "Malware payload (AgentTesla)", "value": "202879ae3880ef4287f8158570b7719a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687947808, "uuid": "ab51fa2e-f228-4f8f-ae34-aaf70c13886e", "comment": "Malware payload (AgentTesla)", "value": "2685ea1f640c12172fb5e136a624f56fd904627b6523a75c7f9357c0313ec518", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687947808, "uuid": "01c86b1b-b764-4c40-82d2-2b0284b4498c", "comment": "Malware payload (AgentTesla)", "value": "df2c3dd623be7b8f31b7f2bd8a5725973058b755", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687947808, "uuid": "5070754d-e68b-4ea7-878e-6689721e193e", "comment": "Malware payload (AgentTesla)", "value": "c7b1466a8d6fe16b11c25af6b837d476dcb930883f8f580a0c9e026a7cdf8afbbe026317b4876c11efadf30ec6cfe63c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687947808, "uuid": "39d94d50-849a-44a9-9e7a-60b2c091882c", "value": "T16CE4283C677D9A22C034C6B5CED584B3F2558F3AB911D522588A7BB56322B921DC333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687947808, "uuid": "8cedde1e-8943-4adf-9192-e8a81114acd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687947808, "uuid": "78c2fb73-460a-4501-b1a1-fe08a97eef38", "value": "12288:bcj6lrSWVmXx/tQm4nUI4rEZHpNWrCXJEwdIbi0odN1y:I4rfVmBOm4UcVMCXewaoHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687947808, "uuid": "edebcd6b-2e9d-4204-be4a-fad27238ece8", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687947808, "uuid": "c9510278-4c51-46f0-9f3e-664e29daf3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687947808, "uuid": "04e197fd-0527-46b6-824d-052fc980a001", "value": "Order CF 2023-24400.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d536823-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962617, "uuid": "c7e55827-9564-4507-bf1d-ba3f6397c7dd", "comment": "Malware payload", "value": "f5ab865e06146180d569e6a15ff6823c", "object_relation": "md5", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962617, "uuid": "cc8b3b87-7ba4-4ffd-9af9-9b9726df8048", "comment": "Malware payload", "value": "2867ebe7d83fb80174fb7bce2c73ff7a0f776fd57b9212294250335402b68809", "object_relation": "sha256", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962617, "uuid": "52da4b8d-01e1-4970-a133-557dad934372", "comment": "Malware payload", "value": "7f2f92af842a2f2e98044bfb20e1a05a585a8ea9", "object_relation": "sha1", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962617, "uuid": "05dc916c-82ab-484f-b3fa-38c867b6c6fe", "comment": "Malware payload", "value": "43132ca6ec40608dbc612151c52cc9ba2bbd059ec65358f329892877c503736b81b45fdae970970a4d07a68443f4490f", "object_relation": "sha3-384", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962617, "uuid": "e6a5fb76-0b45-429c-b772-722791703652", "value": "T1A975ADC2B39D8AD8CE725DF379E1B7C1BD677C250760B0DA2F952529AB301207E1D622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962617, "uuid": "a4a1beb1-529d-4e21-9f81-66007a3e19af", "value": "fc35a0089284ff9c7c45866438ea8a25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962617, "uuid": "e6880029-e20a-45b9-961f-7d70b131ca36", "value": "24576:+4lavt0LkLL9IMixoEiUdLKX0DkOou268noAgCl3KF4LnPoc:pkwkn9IM1UdLKX0DkOjz8o1ww4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962617, "uuid": "e788d978-2758-4432-b422-c404952b4ed5", "value": 1639424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962617, "uuid": "14673277-4fb6-4a85-99a7-bac3a6f0b8ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962617, "uuid": "21e14a4f-13ea-47b4-b1af-21f0060eacc6", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd032f99-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687962831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962831, "uuid": "03e136ce-aa65-43ce-b381-9be7c16bf8e6", "comment": "Malware payload (AgentTesla)", "value": "74e8292040a127216e798db3a9fd3f69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962831, "uuid": "49724b09-6aba-49ec-a3c3-df85b9b4e217", "comment": "Malware payload (AgentTesla)", "value": "289e568e3f98aec8c5391f3a42298e9da0c1ce113b2406b33364bbcee2b2d6b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962831, "uuid": "507acdb3-2028-4efc-97e4-2b4efe7aac69", "comment": "Malware payload (AgentTesla)", "value": "9754a7ab1a5880230661ede2666ddb4e03131bd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962831, "uuid": "b0ba33af-df7c-4706-9426-091fe4b15b00", "comment": "Malware payload (AgentTesla)", "value": "320ec03cb17d917ffd338c1e3ed41bc2f3d7fb26b2bee28072965b08bc77064cf0ead4b8ddcbb9889d0ecadce6e7d841", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962831, "uuid": "387c99f9-4ce0-482b-a7a4-911ea429f6cd", "value": "T19BE2925AE78B03B84F411272171E0BC99A7DB12E735051B178AC937433E9C3A42B6AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962831, "uuid": "7d0c8833-fa10-4a3a-bbc2-a36047ad2449", "value": "768:WFx0XaIsnPRIa4fwJMOQ/8Kx/OzwG8ElO/7qQXzXUnxDLiVYI1:Wf0Xvx3EMJ8AMwGAXDGteF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962831, "uuid": "ee004019-c59a-45d5-9f47-ea61d6d3805a", "value": 32595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962831, "uuid": "9d91f969-3fcb-4763-9bc3-bc9b8fe5d867", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962831, "uuid": "bfef7423-3090-486a-9ef9-0da70c8cd685", "value": "74e8292040a127216e798db3a9fd3f69.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53fe0a1-1558-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918231, "uuid": "e69302b4-7654-47fe-b081-5baa1e79f79d", "comment": "Malware payload (Mirai)", "value": "cb1340c3175d0587529c84e09b3829ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918231, "uuid": "aa79dc24-0694-4e1f-a0cc-fab575f7c9c8", "comment": "Malware payload (Mirai)", "value": "28c718304731c5fc324a5d52ac980cdee385ce3528f707703e06669f4561cb29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918231, "uuid": "8998fa21-90bf-45a3-bbaa-f557de03447c", "comment": "Malware payload (Mirai)", "value": "9a2b75bb4984f36bdc689f8b4539685e69b088e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918231, "uuid": "dcddad7e-4191-4ee9-a8d5-f62f6475acf2", "comment": "Malware payload (Mirai)", "value": "bcbc7876ba33f2143eb025b84605351a53bf975d4cd92275ac61294f0c3fb77305e7e92ad066ee08ba2964fb20fecdb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918231, "uuid": "3b3e088a-dcdf-411a-8fb6-491eab75d73f", "value": "T1F2C2E1E0B722F931C4206C7DE52B4D8A3A51067CD1FF393764258C399EC269A67B84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918231, "uuid": "d0e4842d-2b80-4765-86f4-105a07df9209", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrp9q3UELur:PKy4qfqoeJdXWgcLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918231, "uuid": "79a1ce0b-1ec4-4552-b535-021d3f578a90", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918231, "uuid": "b98aed2c-909b-4153-8658-0400ba9ca09a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918231, "uuid": "8e60aea0-f66b-4489-9565-20295a8642b9", "value": "cb1340c3175d0587529c84e09b3829ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc3ff0e-15e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687976386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976386, "uuid": "87ce0bd3-27d8-4d16-ab37-14966ae9ed5e", "comment": "Malware payload (RemcosRAT)", "value": "31d1b1940cab2cc7ec80370e7f63f25d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976386, "uuid": "5106870f-852a-4372-9260-ff2c34d67531", "comment": "Malware payload (RemcosRAT)", "value": "29cbb0d27bbc787365e8c2aa11205b0218a178eda781bca644f8c77e55ad03c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976386, "uuid": "44952e8f-310b-48f7-9b11-1b00caa930e4", "comment": "Malware payload (RemcosRAT)", "value": "d7b6d2d2cb564ae54d3ed8c9b6db5b561f5ec217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976386, "uuid": "88ed705f-108d-43e0-8051-2cc89e0ea0f9", "comment": "Malware payload (RemcosRAT)", "value": "e1b17d469f30a80bdd73f9cf633bc1ba0cb3d146330d03343a27e28c53771ef389fb8408b99a5770435b7dcb65477529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976386, "uuid": "0c769b03-36b1-4799-b976-7e7ccd35e436", "value": "T1C5A4AF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976386, "uuid": "ad491d99-90c3-4fc8-a044-4f7816281ec8", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976386, "uuid": "a6facbab-28c6-4a63-8b3e-ad43f8d2c011", "value": "12288:RRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2RzDU:Rx7cyF2eSsewS8W47eZOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687976386, "uuid": "4f7497ba-f3f1-4f73-b837-3ac406e3669a", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687976386, "uuid": "47c9b9bc-a792-4c92-899e-0cc24812cd1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976386, "uuid": "3a06c016-7744-4436-96d2-4b50b1291eaa", "value": "xPURgC3T871l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47efbe56-15bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687961319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961319, "uuid": "2b120d06-e75b-4be0-83f1-d5806d126529", "comment": "Malware payload (Formbook)", "value": "fe7fb44408912cfcc134fece3697776b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961319, "uuid": "41c37509-c2ae-4583-bf69-77e713b7a94d", "comment": "Malware payload (Formbook)", "value": "2a8783a8fa5d2994fdce8d2bce2aeb59434d13534e9f13ccae8de38f72f0798f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961319, "uuid": "c31e8ddf-68b6-41b9-8b8d-1dae9a456b3e", "comment": "Malware payload (Formbook)", "value": "f4ba9fd0270bcd4ce6090e950cdeae5bd9880432", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961319, "uuid": "c4ef1012-2b7a-44be-ae16-1231acbfb8c0", "comment": "Malware payload (Formbook)", "value": "3ee0ea4f5b3aad5a0dca0c66a0c947223f8a258618809775b59c0e8e816f0ce40564ab9d25c7ca56505bd36f0c7e43bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961319, "uuid": "ce8139af-909f-4f9d-83b9-b7145a01ba38", "value": "T1E734123067B4C873D15347B12A7977272FD6C8222099AB0B47514A6DBD26AA3F70F323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961319, "uuid": "152e6d63-dd5e-404a-b806-6ad7d86f43c5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961319, "uuid": "2e6be7dd-25e7-4a31-90ea-fcb41bb0b314", "value": "6144:PYa6erNOk21nYN/GQT/J/gUNF8vx+SdJmdMmitT:PYIJEYN/GiJ4GF8vx3dJmdZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961319, "uuid": "65ca6785-5709-41d7-a2ef-3cec37ecd42e", "value": 242647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961319, "uuid": "48be9dc4-b1ff-4fa4-810a-1eabd97032c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961319, "uuid": "615bf776-e902-414b-becf-c2e37230810a", "value": "shegro2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00771ac-157d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1687934113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934113, "uuid": "ef4f0c24-b3c0-41a9-80b0-44299db7cfd2", "comment": "Malware payload (Stealc)", "value": "b350b2674bb9335f837a952e06cbbd1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934113, "uuid": "7fd4bfe2-19fb-4fd1-8e37-e46ca325f64c", "comment": "Malware payload (Stealc)", "value": "2b40dbc2f7446b17b8e2f346b3019bed9e68a693a6a5b80aec0f8c520dd31369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934113, "uuid": "76508d88-9cc5-44c3-87ef-a5c4f64183ef", "comment": "Malware payload (Stealc)", "value": "3c2aa599c96a725076d811cbd7cbd4083688afc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934113, "uuid": "59b676b6-ab19-45cb-943a-04de7278a30f", "comment": "Malware payload (Stealc)", "value": "8a78790a3aba5e166a732cbab213a01843dbcfd30e8268f3e04838a81cf949f235db24f36face1882682e1e421b88564", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934113, "uuid": "0bf3d387-21e6-45a8-b508-83c2a4e527f7", "value": "T17925D6B8699026ABDCB7E7924161044DF37B7422B223CD7826D316C5463291E3BEF91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934113, "uuid": "7f80b92a-81d0-4b23-84d3-a9f600bca6f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934113, "uuid": "52de9c58-3a50-4796-ba84-d9c93d069965", "value": "12288:T3H07FsMPzI/Z8NeMvnWxNtI2Q8AuzFQqNPVZwGvgyuLTT9XC:g7zLI/aeMvnW6juzFlNdToT9XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934113, "uuid": "ab8fac14-105b-4442-8e88-0b7e3fa64628", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934113, "uuid": "f13cf7c2-e70d-493b-8b17-d7f72a476570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934113, "uuid": "9f87113b-df32-424d-be27-8c7f30cdb225", "value": "b350b2674bb9335f837a952e06cbbd1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ec62cb-155c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687919661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687919661, "uuid": "ce99d028-3bf4-42b5-85f9-e89aa227900d", "comment": "Malware payload (njrat)", "value": "5bced86a3e4a66a0a9091a2835271f93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687919661, "uuid": "c35cbeb1-b4bb-4ed0-b2e5-5f5f1d54a4d4", "comment": "Malware payload (njrat)", "value": "2b558fb3080acf42d6e5a14aefcea6ea83aace62bbcc2d4eee33191480557801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687919661, "uuid": "7d79e13c-f710-43db-ad6b-6cd80eb5ff63", "comment": "Malware payload (njrat)", "value": "59860e44dcc31203e7f7a71a8e375d5d7fcd3298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687919661, "uuid": "746e4ab2-09d3-49d1-9234-01251bf60613", "comment": "Malware payload (njrat)", "value": "81c883be6fc7a88727fd019424c926bcd224eb7f5f2e6b0aa5d92f35f86406886d7a3c82e67b82fa8497f916887abed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687919661, "uuid": "6ada5ac3-655b-4836-ae41-1d7d2b102160", "value": "T181E218467BE94215C6BC5AFC8CB313214772E3838532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687919661, "uuid": "b2889cf8-2c17-43c0-b56e-0fe09ae419da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687919661, "uuid": "9ac0ca66-48d4-4253-811d-6c63bc39d277", "value": "384:o0bUe5XB4e0XUpOjfrw0Q0mS03AWTxtTUFQqzFsObb9:dT9Bulj855dSb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687919661, "uuid": "1e5c956e-77c1-46a2-b7f8-b38dc292ba49", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687919661, "uuid": "6dcc363c-9a48-48ee-97b9-de7e89a7915c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687919661, "uuid": "338322a2-72e1-4f5d-ad41-afea8d694e06", "value": "xRDKEIoDBglQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ca53c1-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687961909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961909, "uuid": "83f7178d-4ca7-4bda-8b7e-79be425d2e8f", "comment": "Malware payload (RemcosRAT)", "value": "d03e768f471d9757ddcbd48bdaf26bf2", "object_relation": "md5", "Tag": [ { "name": "d03e768f471d9757ddcbd48bdaf26bf2", "colour": "#315618", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961909, "uuid": "586403e6-2624-46e6-a6db-977b02f2b7d0", "comment": "Malware payload (RemcosRAT)", "value": "2bc364e692d47380f0e7bf27be5f0ec731195552ff3b8951bd5409f18fa803e7", "object_relation": "sha256", "Tag": [ { "name": "d03e768f471d9757ddcbd48bdaf26bf2", "colour": "#315618", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961909, "uuid": "5b79def7-7eee-4761-b9b3-67748556a3af", "comment": "Malware payload (RemcosRAT)", "value": "cb010e91f18badf3d27d2aab560bf866c6ebea9a", "object_relation": "sha1", "Tag": [ { "name": "d03e768f471d9757ddcbd48bdaf26bf2", "colour": "#315618", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961909, "uuid": "709dfa37-e90e-4520-82f7-281f6c3be501", "comment": "Malware payload (RemcosRAT)", "value": "b4a966a33b04bb81fc06de3ef5a48075b06a93d9a37985ef0e8c7cfa69c8ca976a5555047048c1a7dccdce704153a5cb", "object_relation": "sha3-384", "Tag": [ { "name": "d03e768f471d9757ddcbd48bdaf26bf2", "colour": "#315618", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961909, "uuid": "893c582e-6389-48ac-be87-f292fb491019", "value": "T10805BE14A59ADCF8F09B7CBD24A2EA1C835B985763B6C72BA38364904D76305F32C4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961909, "uuid": "23bb552b-4ede-4dc3-b20c-c7a882b5b022", "value": "12288:pStlmSa0+Vn4ad6YBWv7O0BsCtFLazb7erPJCJd0mTS+6gXdltDHQzVjWM/:mlW0+Vnxd6AcaAAshgNQdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961909, "uuid": "d4bc0adb-96f9-4256-898d-9f1a4b51538f", "value": 872464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961909, "uuid": "017f5154-9608-4a70-b4e6-418df432a5f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961909, "uuid": "d0fdd70a-6ac1-45c7-9f34-1ff6050c5b05", "value": "d03e768f471d9757ddcbd48bdaf26bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134aa7dd-1580-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687935031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935031, "uuid": "b319f721-6fbf-4215-911f-cfdead9bbb15", "comment": "Malware payload", "value": "cb0a924d50d94d1f9c2d42c225be333d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935031, "uuid": "d20cd730-30c9-4b28-b0c0-e2c927c5aca3", "comment": "Malware payload", "value": "2dd746dc2726f92646c1e10b63a62e728508a1f12a970905053afd0ded68023f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935031, "uuid": "2c2b1c2b-b8e3-4060-97dc-4a23c665f81f", "comment": "Malware payload", "value": "61c7ff47cd1f444d4c974212baa6a7469e141c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935031, "uuid": "e3665b7b-458a-4009-aae0-518737e98ccf", "comment": "Malware payload", "value": "a3502949283bc063f7b682f3c67650be8f2760cd4f1cad0ad2ac992de42b7aa2b78ceec515b04e4725caaa22c2a39e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935031, "uuid": "3be753f5-d22e-440e-86ba-4cda28414bd3", "value": "T144151202BEC299B2D0661D335B656B20693CBD202F65CEDFA3D41A5DDE215C0EB317B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935031, "uuid": "04a0afc8-e7e7-4590-8a15-90af253b2ad3", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935031, "uuid": "2ffd50de-be81-4b45-8e0a-b0a123cfd6e1", "value": "24576:2TbBv5rUyXVXcJApapb36Ea6zjckIMyPADtuCfb7:IBJMKgpbiojIbKuCj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935031, "uuid": "b0d2dfb6-2bf7-41a7-aadf-d54cfb7aa545", "value": 911143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935031, "uuid": "f650fd05-c880-4ca8-93af-5733614589a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935031, "uuid": "95b9d237-0095-4735-b68b-f85b70e333ea", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201275bc-15cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687968983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968983, "uuid": "8d950a99-8d24-4b3b-82e2-4ae89fef7386", "comment": "Malware payload", "value": "426a0b632685e95a7dc412f83cff7cc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968983, "uuid": "a10457ea-2a97-414a-8dac-bbecc417795f", "comment": "Malware payload", "value": "2e5d574906604a038604f9fd6604ae750fcee4b156c3a7fc7fc8fc42b7d52b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968983, "uuid": "05661dd9-21af-43d9-becb-15f5dc731609", "comment": "Malware payload", "value": "c2e1419ac6ed88f997fedd90ef08924c77d699c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968983, "uuid": "06721538-c7ab-43c5-ba5d-625efd4ff93f", "comment": "Malware payload", "value": "873fc5029d8ae4ef63289534ea1c508df47031fee60b94332874e5ade69bdf3d184c011c38ced794c66355a6d8de85e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968983, "uuid": "7695a131-16ef-45ef-a01f-abfc71313069", "value": "T11D95AF2177A084BAC1B33531552E83BDA6B5AA205B3952F357902F393F305D29A3C76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968983, "uuid": "eba2f491-bb72-462b-bd94-e3cbdbe53f63", "value": "bd002053ce543385f312df496cd35b78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968983, "uuid": "23b688e9-a664-4997-a8d5-925109f819ac", "value": "49152:dmUCGL+kDxiSOASJCIYYTZI2yxRbxb0lSzfNpOUacN3d4idakw0Ju6MnrV10:QwL+gJGJCIYYK2yxRbxb0lSzfNpnH3u0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687968983, "uuid": "a2932efe-832f-4fd4-ab38-a29b6cd8cb53", "value": 1895936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687968983, "uuid": "3186dd24-85c7-4f46-a2b4-c7e86edf64c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968983, "uuid": "5c68f7d4-f02f-424f-be70-ea51c0844511", "value": "hanabi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c05d8e-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687933269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933269, "uuid": "856500a8-6ad1-4d2a-abd3-865deb062198", "comment": "Malware payload (GuLoader)", "value": "aabdcbf84c6fcab85dcad23199d59dcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933269, "uuid": "2cf913ec-eac9-493d-8728-6f608eba0842", "comment": "Malware payload (GuLoader)", "value": "31d4c269b0dd6e27c9c41be60777c4410799e2e3965dfef05221aff9da62dd3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933269, "uuid": "b05984ad-6c20-4f83-bb60-334aa771983c", "comment": "Malware payload (GuLoader)", "value": "43960e5e15b60496be59b829f216c8e1326db2e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933269, "uuid": "34d6f783-b74c-42a1-a4e9-35b34dc28b2c", "comment": "Malware payload (GuLoader)", "value": "9afac8ebd529d829dface3421ef265ca9bc34670ca3f9f31ffbb61fb21b39e1f9f30a17edf6eb849456d741747cc9977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933269, "uuid": "a6981f26-7deb-469e-8918-7fb2b08b6bc9", "value": "T13605237D5070E66BDF0E0F7A3B7964A043E5523B06A527C72B641B29A01734977AF323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933269, "uuid": "3f9d474d-5a38-42aa-a35d-a4cc847082fd", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933269, "uuid": "3520f8e6-ac4e-4d6d-a521-7d85fb8649fb", "value": "24576:E2eH2kFFfZpiTV/wurEnc3Rx5+NVVyYM9:PeH37cV/rrEchnSX1M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933269, "uuid": "11307e47-12b6-468f-840a-780856d05b43", "value": 836318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933269, "uuid": "939fdc59-f9af-4c01-b4f4-f8375e14810b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933269, "uuid": "356e219d-5074-4e89-b583-8301e4d391f8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c96a1e6-159e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687948120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948120, "uuid": "f2789cf1-2cec-4735-b244-04f79d794c42", "comment": "Malware payload (RemcosRAT)", "value": "3cb220d6b47930681a1e50ed68afb1c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948120, "uuid": "f28825f6-2f4f-4f16-8b2a-8bafb3051a90", "comment": "Malware payload (RemcosRAT)", "value": "34bfed7f2450542d851b696685ed0a43438683a54f1756a947119d7258a4adb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948120, "uuid": "65b6a8d7-18e3-4091-91ae-efa6fe38a379", "comment": "Malware payload (RemcosRAT)", "value": "b69a2ea6ee6cbf1c72ac3760527903a231f2c6f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948120, "uuid": "dd03f6cb-f184-49b3-a86f-8f8cc5800d46", "comment": "Malware payload (RemcosRAT)", "value": "476df759263a89804c765d38a2aa51babbc367e8c0a7ef67e04746de9376f80bca0907f187afdd06dad604c2e729c139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948120, "uuid": "c735ecc6-45e9-4e27-b8d4-5d58c5fc906e", "value": "T10E257B3C677D9A22C034C6B9CED584B3F2558F3AB411D523588A7BB52762B921DC332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948120, "uuid": "f9985ad8-83e4-408a-a9a0-36eb0ce71b12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948120, "uuid": "e3c510eb-ba7f-49f8-a4ef-6423844c7618", "value": "24576:TnVnRJfPMKe38+aVqfk1r957DWZmsgPa:TVbPgyVM09pRsgPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687948120, "uuid": "9941514d-4f83-4979-86d6-05fec31626e8", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687948120, "uuid": "72f5d46f-7e3a-471b-871f-0d286a53eda7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948120, "uuid": "e4fe8c55-c0c4-4fd8-9ee3-a7fb606e8204", "value": "SecuriteInfo.com.Win32.PWSX-gen.20293.13524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0b2ded-15bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687960680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960680, "uuid": "3341556d-4a1e-48ce-a28b-6c707ee765d2", "comment": "Malware payload", "value": "00c63180b9669caf1a5c59e0175a0b3a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960680, "uuid": "c7387ad0-894d-46df-ab96-a2b0057e5f21", "comment": "Malware payload", "value": "34fefe9ea75b77427a5072e3138b21d329975ae0225506f7449e634bb2978fec", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960680, "uuid": "0ea960f6-0678-45a0-98e1-d898f9fe2ee4", "comment": "Malware payload", "value": "ef2b36d05d894a214c1aa2447372df12606e96b9", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960680, "uuid": "d18138a8-807a-47d2-a9d8-bec9767d1755", "comment": "Malware payload", "value": "d5846ec6b26effeb6a07c8b30463a027c59bfd8eee0e0dfebb4b4bd4b15a3d28c545d362c6049741f16b4e8e2cdc0660", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960680, "uuid": "bfbfdb0f-3557-49de-bb43-746df396963c", "value": "T111A423B1F140732CFE650434E5F22AFF50A9873A85D961C2434694D2F6FF58BA42F9A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960680, "uuid": "7f0cde9d-b24a-4a20-89bb-e31e00f81754", "value": "12288:ApiT9bHFelhF52c6C9O53uxRf/zQOuKZlE7x:Ay9bJCM9uxR8O9Zkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687960680, "uuid": "75bfa343-56e2-4509-81d3-6897b8b16174", "value": 471015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687960680, "uuid": "136e352b-43b4-497c-a64b-46a65d7e9141", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960680, "uuid": "b1899ce5-f785-4b6f-93f2-9de385a3f080", "value": "00c63180b9669caf1a5c59e0175a0b3a.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cef27e4-1584-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687936900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936900, "uuid": "f7f6fa77-6912-4088-ae14-971c3f8a00d0", "comment": "Malware payload (AgentTesla)", "value": "be7458c66b2efb2e5be938b1fab3f0b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936900, "uuid": "d7bf984c-3a0e-42ec-b321-d464e9b28a2a", "comment": "Malware payload (AgentTesla)", "value": "38ebc69c74b725dd718347526fae22d544303288edf2bc3729e9cc47be548aa4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936900, "uuid": "87e104c5-e8f8-47e6-b29f-97734e0b8bc9", "comment": "Malware payload (AgentTesla)", "value": "1d25164d9ca6ff401cb9782b800a093d4d7cdfe3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936900, "uuid": "161f8120-3c93-4d62-a95a-00c038c05e76", "comment": "Malware payload (AgentTesla)", "value": "48f11313c1969043b33177f7d779b745e76ecdeeb71c24404d76ef19d12242013d9e71f3eaa6b7859ed9d7d182f95555", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936900, "uuid": "f043d719-f3c7-4212-9d30-3690ab703013", "value": "T195C4236A9B8C128D5800E5F7BEDFAD9379E6E5D0F32142A2B53628719A0001ED3BD5F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936900, "uuid": "32bd2823-176b-4c54-871d-01d71309d0dc", "value": "12288:ks+GjEZF9dzHlhq1k9Iv7bBvKk7QPmEMIAdjpfUAmuEWgy+mjW/1:r+GQrTzFh4v5R6Amtyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687936900, "uuid": "98278e8c-0764-466e-898f-3c757cd0e608", "value": 592414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687936900, "uuid": "d015df2c-aed6-4392-b162-fb80782dae70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936900, "uuid": "7024a9dc-4a1d-4410-9db5-4b2066dc846a", "value": "quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38cd425-15ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687980827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980827, "uuid": "1d258d27-cec9-47d3-92ab-7531acd87e08", "comment": "Malware payload (RedLineStealer)", "value": "7b6479306a1bb71a9fb4413e295bf683", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980827, "uuid": "8d7438d8-4129-4600-970a-9a8a55cb8bae", "comment": "Malware payload (RedLineStealer)", "value": "39215d069afee8965abfee97b1c32dcd45e3cccc2282dc8118a1e2f6990ec02c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980827, "uuid": "4e43e35a-ec08-4f71-9b15-ec93064b09de", "comment": "Malware payload (RedLineStealer)", "value": "20eb8f9ab7b54c93ef9de90a2108c02771f64abb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980827, "uuid": "62c54f9b-8ae9-4f47-bf7a-8234cc5a0d32", "comment": "Malware payload (RedLineStealer)", "value": "ad96b1579a9a4d796a46ae8c18c35bacc959ad1fb3761e0f85f99de3d1833064467bcaf681cff268a2be45e94fa1d61c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980827, "uuid": "690e1f58-e8e2-48e5-8a8a-6d1306ae6727", "value": "T12E258C7579B48172DED220B612ECB525017FE3B007B7A9C777D847EAD22CAD07A31982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980827, "uuid": "4b77ae68-5215-407b-ada0-23088e37398b", "value": "68fdd1c7294ac28e69cf031b36cbf00b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980827, "uuid": "c593d8c2-0c0f-4a93-b770-17c9a1811f22", "value": "24576:YSHN/eXZGlK69vW1dXPvA8BkYbIg/moir37:YXZGlK69ujAE/1uoiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687980827, "uuid": "cbca1a91-db20-417c-8d8d-20a46ad66b06", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687980827, "uuid": "fb3d5bd2-99e4-4afa-887e-5e74601d8748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980827, "uuid": "e820d1da-12de-4533-b60b-c71558595fda", "value": "7b6479306a1bb71a9fb4413e295bf683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b898e6e-1584-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687936924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936924, "uuid": "b7255cf7-b23d-45b8-a495-28edc72eef4a", "comment": "Malware payload (AgentTesla)", "value": "a0fbd9d74c513c8376c9e40725ab1d4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936924, "uuid": "20f39214-37f7-4caa-b203-b7c85cb109b8", "comment": "Malware payload (AgentTesla)", "value": "39854874b738bcff91ff8759db8cad631739d5c2309b675d1bbf6d60da15d3f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936924, "uuid": "5e69a699-ae6b-419e-bfb2-c9e6f309d0a5", "comment": "Malware payload (AgentTesla)", "value": "6118bbf6c9252ebc5a7ed65e1e6e7833a42e9196", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936924, "uuid": "d411ef50-b742-40dd-b7fd-2b76573d685f", "comment": "Malware payload (AgentTesla)", "value": "148a5d5ec6ee5c28e81cc2e8984f8be033f929cf5c5a5a591faf4ed0890eef4bf2454fe87939afcbf19a8d1e176ce552", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936924, "uuid": "551a90c6-09b5-4a59-89e5-be13775903ae", "value": "T15EC4236A9B8C128D5800E5F7BEDFADD379E6E5D0F32142A2B53628719A0001ED3BD5F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936924, "uuid": "0e4192ff-39f1-465a-b64c-f2ea6c82f4cd", "value": "12288:8s+GjEZF9dzHlhq1k9Iv7bBvKk7QPmEMIAdjpfUAmuEWgy+mjW/B:T+GQrTzFh4v5R6Amtyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687936924, "uuid": "be6bd952-0eae-4446-9b50-6c92761414d2", "value": 592434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687936924, "uuid": "e17313dd-7e61-4e4f-802b-14658d30bf48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936924, "uuid": "c3115463-920d-4296-91fd-9b8dd82eb128", "value": "new project product.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bceed528-15f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687985997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985997, "uuid": "b59895dd-1c7a-4ece-9ec5-b8fb98cf52a3", "comment": "Malware payload", "value": "44a416180451c6216f359ec19958bf80", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985997, "uuid": "4051a5c8-283e-4520-9727-a04f86675e2b", "comment": "Malware payload", "value": "3c51f761e30dea35423310df9023e2e0f986193e0ec73c6a5a0e5f0faef3bb51", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985997, "uuid": "8c6cf5d4-659b-4451-a87b-bb4c8477296d", "comment": "Malware payload", "value": "d185227ce344a8a9d5c141ac7dd20ed1a11e0dbb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985997, "uuid": "526e9cdc-60fd-48fa-9ef5-58dde08c3cd9", "comment": "Malware payload", "value": "e01721e6973da87d053fc2aa61f3f03fc57a535526cefc058bd024e03ff1e9ff1f0093eeff33a9b718ba2e9881eaebe9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985997, "uuid": "a57fcca5-83c8-43a0-ac2b-100ec526f53e", "value": "T14B341309D7371CB31FF8E216666A5BC40E214DCB85F43099EA9FD19B37F428C6664B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985997, "uuid": "2466db66-fc96-41d1-82a4-41b31aa419b1", "value": "6144:bv6IoCw4cttAZh3+ih1ssPhxKqZUCn6Ba0:blw4cUZsyPiq1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687985997, "uuid": "942156cd-1040-4864-a2dc-2824eb2f207f", "value": 236571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687985997, "uuid": "4e06e7ca-4eb9-4653-8e7c-1c8608f1b98e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985997, "uuid": "023586be-3b56-4411-a37f-4849843eb7da", "value": "XTARlmbt.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a802f2-156d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687926850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687926850, "uuid": "3e2a1d84-425c-41ff-a0d3-db4524346b00", "comment": "Malware payload (RemcosRAT)", "value": "4daef76971794649d0c0bcc97a9fd246", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687926850, "uuid": "56d10d59-e65a-40c0-b276-302de7a4ccab", "comment": "Malware payload (RemcosRAT)", "value": "3da90b636e39cd1f67e3542c60d813c6ff8152f7f740b3ef4ef086ef120836df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687926850, "uuid": "8fe504a5-3346-46cd-bb0b-d8600ad37988", "comment": "Malware payload (RemcosRAT)", "value": "49522f33f7f2852d9637c98d560437b4d88adcd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687926850, "uuid": "08be2998-625e-4a1b-b314-dc06f2134805", "comment": "Malware payload (RemcosRAT)", "value": "48f15dea11dac57a2a425c884ea363ef62a425d0c6668f1b6048a6b2ac6040f56c3e957b6ac18b5baa025dba17ef70fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687926850, "uuid": "d85c4989-5902-41a8-9071-24dc152531a9", "value": "T170B4120BB61CA76EE39B47737C3D06715698DF231A606A05BBC1FD1E243158DA90B3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687926850, "uuid": "4eb03539-969a-49c1-9094-d17e11e1492a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687926850, "uuid": "6bf93ea7-661c-4295-ab63-5c935c0723e4", "value": "12288:0YxD6czlyK/Mu6h3qbnqy5FeTl52WtE8uped:0YxDjlF6h3AqucP1tbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687926850, "uuid": "eacb4749-9ed2-4fe7-89a4-b7f3e3f2d82a", "value": 540532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687926850, "uuid": "255650bd-ee8e-4ca6-a31d-f505629091de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687926850, "uuid": "8f8d2ce9-e688-4f5c-b3bd-390c7597dd92", "value": "4daef76971794649d0c0bcc97a9fd246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8459f4a3-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687935651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935651, "uuid": "ca268b87-558e-4114-b67e-5d09756aaaf8", "comment": "Malware payload (Mirai)", "value": "f078f71fdff5387e761a6725ef5efb79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935651, "uuid": "6a5577a3-7152-46d4-9113-5bb9e992bf22", "comment": "Malware payload (Mirai)", "value": "3fbccca735fb5e9d48cdec0529f76b407d8aa2f7dc1bde14ce53210b3fba214c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935651, "uuid": "a7aa259e-816f-4886-bdb2-cb07be895b81", "comment": "Malware payload (Mirai)", "value": "9316bce4f19d3eeb7f0c3f548e963c371e538797", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935651, "uuid": "c96904eb-72c6-4951-b921-e9c08aa6ebfd", "comment": "Malware payload (Mirai)", "value": "684edfdfd54f820dd641259943e2b8170db70fd5ad01cb4867e932551fd3a51c2958aa8b34c428531cd5224f218d3506", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935651, "uuid": "c686a015-e46d-4dbe-a2ea-694e107e312c", "value": "T17403D785B9869A07CAD4537BFA0E42DD3B2573C8F2CE3313DE162F51368A92B0D6B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935651, "uuid": "281b8f1a-ad23-4d44-bcd4-1512a27e5be3", "value": "768:L8cgPbzj5HoD2ogElo5fEFn8fuP5KZ7mrLIZUI:Ycg8oDfnfuxy76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935651, "uuid": "2e5c064d-a86e-4a9b-b539-9b6e20429c80", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935651, "uuid": "bb9e5a99-cd24-4f8c-a7de-7e9de5999924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935651, "uuid": "e28dd26d-dbd9-46ce-ba96-2ede31349acd", "value": "f078f71fdff5387e761a6725ef5efb79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb771e7c-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687962828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962828, "uuid": "c3b604da-1471-4c63-8ae1-330b5a7736a9", "comment": "Malware payload (AgentTesla)", "value": "9e32ed4699dbd084c1f901471d4fa022", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962828, "uuid": "30ba066f-922f-4fe5-a906-ca389acb7cbf", "comment": "Malware payload (AgentTesla)", "value": "3fe32b6585d1b08c476c9d32be35debd2128d76780fb48558565a8d53ad71c34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962828, "uuid": "76c10fd0-546c-4189-b0bd-e5f7c1cb8976", "comment": "Malware payload (AgentTesla)", "value": "dea5d610f385d26e095b3ce49d01e3fc077093ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962828, "uuid": "d659350b-bff3-4227-b7b3-9dc9b989731c", "comment": "Malware payload (AgentTesla)", "value": "71cd7f836a8c02fee2867134e13f5bf6fddef61973f720d8db0f33e1f780951e50263abfcd6ad8eb8855dbd8b3551127", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962828, "uuid": "3a9b2363-601a-4fe0-834a-c6e292b1d122", "value": "T160251206F995E96BD85693387892947A410CFC25D3A8E4436B0ABB4F04F49B0C8B77DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962828, "uuid": "ad30f554-9e5c-4837-9ad3-b8ac82be9e37", "value": "24576:Ozbzfw6sHo0xfsjcUos+xKWz0w6sbo0xfsjcUos+xKXurpeJ7vSm:OPU6sbxfsjdos+xKWT6svxfsjdos+xK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962828, "uuid": "88eb8477-ff6f-4606-a6ee-cd07c0666ab9", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962828, "uuid": "b2a828b4-d24f-44ff-abf2-f84a15716af5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962828, "uuid": "76b9f5fc-90b8-4e85-bd72-be1a5b3a7343", "value": "File859687doc.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd0ef35-15a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687950377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687950377, "uuid": "a34709e7-6287-47c0-91ff-64158f1d65b0", "comment": "Malware payload (Formbook)", "value": "2d97dbe3882c05bb2281b27d21675218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687950377, "uuid": "8c5febf9-a314-4b74-83e6-147f17284b98", "comment": "Malware payload (Formbook)", "value": "40a843a0603d0fe585a83443f4dcf86c4b867122946e25443c5c3288f56efd8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687950377, "uuid": "ed55bb4d-48a8-43d9-b084-5cabc45479eb", "comment": "Malware payload (Formbook)", "value": "9ba15e67bdf1af12ef5a975634ce767be8f3219c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687950377, "uuid": "cabdf65e-6bfa-459e-92df-7eedee3f51e9", "comment": "Malware payload (Formbook)", "value": "788eae0825dd52d2df15276f650dfccbfde49830272889d2f846feb044f2ab25b16713a0fea5f8f0299c76fb1d751ee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687950377, "uuid": "c2bfe376-1d7b-4779-a195-9bb80acccb59", "value": "T1E54402C4ABB994F3E9524E32113ACA09BD75ED3819409B874600FA6C7EF52D29D0F367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687950377, "uuid": "7e8290be-76a5-4fcd-b8b3-4bfc774ce575", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687950377, "uuid": "e5e57fd2-aa94-491f-b7a4-f75ac64ffbfb", "value": "6144:wYa6OVOayqELplP5XTFD7okEkUEEcTsNPMj9xO3ckGUXX9SKE:wYAgayqSpR5XNr7TTsNPMm3yAX9zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687950377, "uuid": "b4aeb8a9-31b2-4aa7-938d-e912cf4a38e6", "value": 276766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687950377, "uuid": "c181d3e7-74a9-4cd3-b3c7-0fa1dba4e133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687950377, "uuid": "be84e9bc-e742-4dd8-b092-c76b69e3613e", "value": "z1CurriculumVitaeIsabelGonzalez.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac323549-1585-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687937435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937435, "uuid": "ccf9ef23-6319-4c04-883b-5e4c2aad7bae", "comment": "Malware payload (Loki)", "value": "7bf4d160bf556a98704d532139b00a3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937435, "uuid": "0b90ab3a-12b3-4ece-a74b-6b7b90916b30", "comment": "Malware payload (Loki)", "value": "412efc866a0ed2c64258a64ad7f957099a46553fb1256465d3b1dc74da1121fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937435, "uuid": "93826c76-eb5d-4b49-931a-3ba57bf07c19", "comment": "Malware payload (Loki)", "value": "7f37428fc004f769ecd64051bfe5bb670df82f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937435, "uuid": "a01e622c-3dd4-4091-a9a2-b2b93a8ee0b1", "comment": "Malware payload (Loki)", "value": "a911dca780f2a9539533c552c6a019ea72251af7eb4d1b0dc3aeb7501b552c2cd7a04b4ff87654234ffc4ea2d1b2766c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937435, "uuid": "64421867-1d2c-41e4-b09e-d7da580f99f0", "value": "T1E2B423B5738ED023EDF207B00636152A85AF9B16187A8A6757441FD93D2A9878F1F333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937435, "uuid": "0130138a-a829-4e05-a07d-ce4d1c864ebd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937435, "uuid": "76468079-0508-4ce9-825c-d19772520f8a", "value": "12288:ZYDx4JkrYmHx7TdA1eWi5GCk/8Sk+QbifCdmxUM2M:ZYDxjrYedBA8SU7+BC+UMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687937435, "uuid": "9b4968e9-aaf4-4990-9da3-c6f861fa8f3c", "value": 537497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687937435, "uuid": "02508457-8f4d-42d0-ba05-6b90b39708c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937435, "uuid": "733d5daf-e0d3-4795-ba3c-dda668c0ccb7", "value": "SecuriteInfo.com.FileRepMalware.18044.32672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a28e95-1586-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687937642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937642, "uuid": "c2347bfd-142c-42a9-8250-71f48e9593b7", "comment": "Malware payload (AgentTesla)", "value": "b3ef016f54f183fd2af6388d72ff2f91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937642, "uuid": "77fe665b-c234-44a6-81b3-c2f662c9b786", "comment": "Malware payload (AgentTesla)", "value": "42131014120f6538128d4ca52b1eae8e23a543a5a7c56a42602f8e19fccdafa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937642, "uuid": "b599b69f-c95b-4450-bb40-cef9e6a2e1ef", "comment": "Malware payload (AgentTesla)", "value": "7e48d5902eeb0ba793f15a8091111795d92d71b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937642, "uuid": "6e2886b9-da2e-411a-8259-d31e8345e18b", "comment": "Malware payload (AgentTesla)", "value": "02d12a44de315b0b69b1ea8e42e915a82f2aec535625da8a40c92ad6ed9bd444f0f76e010c2224db8a52eb0418cc7eaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937642, "uuid": "9dcb3109-184c-4f66-8c47-bb032ef058ff", "value": "T17EF441BD29802EE79475E5B2C263089DF63F71327E134D6B26D253C1862652E37ED80E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937642, "uuid": "d315e3b1-6b95-4c04-a2d4-c3eeee52a8dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937642, "uuid": "2959adfe-fa2a-4324-af5d-bdc21d6016b2", "value": "12288:HZn3L0T55u+pRvKpe17N6J/c/+LyH5ugcGg:2RypM4Jk/+Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687937642, "uuid": "aa15058e-fc19-4908-880c-04326153795e", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687937642, "uuid": "979346f8-ca98-43eb-af1a-21ba0c45caac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937642, "uuid": "21ae38e4-71be-41f2-8a53-622f87b6b7d8", "value": "Invoice of 53 Flights.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4788cf3e-157e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687934260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934260, "uuid": "eae626af-d9f1-4f51-81ae-ad4439053b9c", "comment": "Malware payload (AsyncRAT)", "value": "b65620767e6518e9f5a393458bbcf180", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934260, "uuid": "3ef609db-03ee-4b66-a4b1-769eb803575d", "comment": "Malware payload (AsyncRAT)", "value": "423b40807bdeece25c9201c5bbab748c81a1db366b419896bd984caea6f4a406", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934260, "uuid": "fbdc8628-8698-40ab-b0eb-347525cbee9a", "comment": "Malware payload (AsyncRAT)", "value": "b372bc3f4d39863fe1ee80e67979fab2a06bf1a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934260, "uuid": "71922340-a0e0-4c71-8d9e-e84c94806aa5", "comment": "Malware payload (AsyncRAT)", "value": "050917caf8f3b5de14f44de68f5c3d459666efe6b8f7d53e889b59f925d8f256c9afaa7338caf6315aefc4b1fed32933", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934260, "uuid": "92132069-bfdd-4efa-8d81-5c859fbee03d", "value": "T1D5044A1433E85919E3FF9FB8F4B002268BB2F8236517D76F199458EE2D62344D910BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934260, "uuid": "a0a406e2-6ca2-4a66-937f-91388c6799ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934260, "uuid": "0af9f4bb-9e05-4586-b8b0-a4ca072e9805", "value": "3072:S+STW8djpN6izj8mZw9900qX2lD9PvWqHPu/i9bxJ2cR6+WpP:P8XN6W8mm997lDhOGPSi9bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934260, "uuid": "02738b77-7078-4c2e-9d08-9e2b7329efc2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934260, "uuid": "babe5b86-741c-4a2a-9dc1-d7d7b38ee979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934260, "uuid": "6c7d6120-26b7-4c8d-847c-8caf84961246", "value": "b65620767e6518e9f5a393458bbcf180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cb32ce-157e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687934234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934234, "uuid": "44532954-f4bc-446e-a05f-f491ed2e3c0a", "comment": "Malware payload (Fabookie)", "value": "b2499af562d13758811eaf4ec09f8be3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934234, "uuid": "9ffe17f6-685e-46e0-a58c-2cf2cca557d3", "comment": "Malware payload (Fabookie)", "value": "426d32b2eb4b85ee5ecca83bbc7afe89cd5774110e2bfdb3189c20fdae04e86e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934234, "uuid": "92114477-6bde-4502-8d5e-eb9d47779e01", "comment": "Malware payload (Fabookie)", "value": "6b8c28a80974d344ac790b9df30a2bb6d7d18b87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934234, "uuid": "1164c7e9-eab6-42e4-8953-339be8f24fe7", "comment": "Malware payload (Fabookie)", "value": "73bdbb340914df9e26d000689be63bbd4580b591cd2d019a7e56c6711d1a4a51b6a002cb52cfa28f8b31910e29dc7fc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934234, "uuid": "0c9fda9d-cdd7-425f-bffa-59837716fb6c", "value": "T1D7941849FB7408B5D096C531CDBE8376E272BC831B25930B8641FF5E2FF362169A9681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934234, "uuid": "0a7d0645-af11-4dc2-8af0-d37c275709d1", "value": "ff082fef3d15cdd142534440e54d6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934234, "uuid": "26cc1876-da56-4044-bfef-902b26d1ea54", "value": "6144:iycu7sQLwcrHMio4T4MKBz3I8JmGerEhgVIXFML:ifwUcrR/rKi6ZerLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934234, "uuid": "5fcfb527-3397-408f-996a-354061d4a8dc", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934234, "uuid": "5dc408c7-4e40-43f1-a74f-c6b90d015341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934234, "uuid": "957c8135-c97f-4300-bc34-1c3b7961a14e", "value": "b2499af562d13758811eaf4ec09f8be3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc2a477-15bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962104, "uuid": "fac67bbf-4394-49f1-8f30-6b74ee93917d", "comment": "Malware payload", "value": "d5c4228fa3eb4bd9652f13e849de914b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962104, "uuid": "b5fc560b-82c0-42d7-822e-b31ac03b84a0", "comment": "Malware payload", "value": "42fa2465262a38c68c5ffececfc6068a34916e2ac878c742429f63ec2efe0f27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962104, "uuid": "d065c940-a0f6-4a71-b94d-2df8cec6b24b", "comment": "Malware payload", "value": "dc148cc1bbe82dddfdf9b5d74b96fa1a75e117b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962104, "uuid": "611c8a79-e57a-4609-87f5-cc6dda065bac", "comment": "Malware payload", "value": "9262c11c240345867a27c73a78f93ffdd7aabc2cf90e1d3aa6584bc55956046dcb59c3a89ce346a144725a2d6b9c996b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962104, "uuid": "9eadec2a-bd8b-4a60-ac29-ef9478e3ee07", "value": "T1D4E48C94CE070B6AC93DBEBF4C9595EB4A2955B77305C2F921E00EB0B0C99244FCA6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962104, "uuid": "f31f1c2b-690d-4c60-8468-59cef86db4ab", "value": "12288:msJyxDXXdqxwp5yh0C8/vRc5iTuLgTHEjrPaxqiZkPKnUOBvCIw0r7BDHvn:mGyhXdCwp5yhp8/ve52pr0pi7UQRTBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962104, "uuid": "d9a81c23-a2e0-4379-ac65-0cdefe6b8f99", "value": 691216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962104, "uuid": "802c6092-5127-462a-ab2b-355616977bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962104, "uuid": "08049932-c509-4f2c-887a-3d40e4b645d5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d886db-157e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687934504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934504, "uuid": "1cd8a0f9-3bed-4c54-8033-d7e725effce2", "comment": "Malware payload (AgentTesla)", "value": "ef7ccbf950e4e5e31fd1f5da8dad110a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934504, "uuid": "ce293b94-6bd8-4fe2-955f-cdbd78b8766f", "comment": "Malware payload (AgentTesla)", "value": "43ce74b24e828ba294f7247f66878e92d965555ffc05a06299e2e4938bae5ccc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934504, "uuid": "7e46037a-12dd-4d10-9b8f-ead439e0e66f", "comment": "Malware payload (AgentTesla)", "value": "18e23b9650793304de1964443b2115f7a0f60124", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934504, "uuid": "35cdb1ea-5a7f-47e4-ac05-60e5cf842f86", "comment": "Malware payload (AgentTesla)", "value": "f7ea9712644d5a0e5c628dd99e9ffd574f9a64859b2677f474a081afb1074a37abc6012906804cae406e65d2d50191eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934504, "uuid": "21c0c3ad-c294-4960-9d93-1f9ca17d4835", "value": "T1964508BD69402E97D835E5B2C263199DF63F70327E134D6B22D253C1862652E3BED80E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934504, "uuid": "02dc6846-9949-4611-9a39-bb2800e8194b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934504, "uuid": "79413b2e-1804-4837-81f7-ac1a0efcd5cc", "value": "12288:nbrX3ihlCebvTACaf13EoHxfk/yAskPuaIc5IzcPTCX3h7sGUegQ0guRgwyOg:b2zCu8nf+OxMPhPuaI7g27sGUFrg0gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934504, "uuid": "c3c9ecba-ff4d-4254-a775-dbb42f5b1495", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934504, "uuid": "d74b0cf4-3ec9-44d2-bf2c-d2a6ab540230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934504, "uuid": "3d084fdb-67ce-4408-9a29-36797f481931", "value": "CI & PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd46a7c2-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687987339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987339, "uuid": "9947f0b6-00a9-4492-9615-10a3944bdf2a", "comment": "Malware payload (Formbook)", "value": "e34a10782d9dac4b81cbc788ac151fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987339, "uuid": "6c8332a5-41a5-446f-91f4-4a01fe4db99d", "comment": "Malware payload (Formbook)", "value": "44de3cda2390b20b694a4121a3fcf1f940e2c5d50e5bcb8f13ce975c7fc962d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987339, "uuid": "02db96f0-5f4b-440c-b853-0b5b0c915738", "comment": "Malware payload (Formbook)", "value": "21516e86b86b245fb6520ae16a69814bfbe9c494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987339, "uuid": "13afb24a-cd91-4ba1-acd2-1c2110dc6701", "comment": "Malware payload (Formbook)", "value": "6a05537745464300577778e59279df154bdeda44a4412161852574f073cfbdf67b9f1e20f7fa60a6553cea926786ffbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987339, "uuid": "221e80c9-c88e-4679-b424-5a7e12e31a92", "value": "T1C69633584F94F7DEE7A18D3625F5120AABD9B1638B57CE9FCEC836200121BC8EB2554C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987339, "uuid": "bfcf6088-257a-4726-a7af-fc8b37ce5135", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987339, "uuid": "102c2310-20f7-42a1-8519-52776e30023c", "value": "196608:whTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mT7:eTb9epDz4MZZ4RmxYDiScfhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987339, "uuid": "15d2fbfa-d354-476f-868f-2f8a06bcfbfa", "value": 8653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987339, "uuid": "79f5e411-2306-44c0-aabe-9a9be08b645b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987339, "uuid": "ecede65e-75f5-4ef8-bd6a-11c13b7853cf", "value": "me5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d97ba4e-15ad-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687954537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687954537, "uuid": "bfde9e63-01c5-4bfc-9638-48bdef5e6e2a", "comment": "Malware payload", "value": "58bb587218f24dd6066c56ee3dc9e250", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687954537, "uuid": "359b2d5b-877f-49e4-955c-820a46eeed80", "comment": "Malware payload", "value": "46ecfef99cca7791e1774532f6cce55d14ff8ead55370c766f8778cf698eef2e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687954537, "uuid": "bcfa2e30-bfc5-474d-865f-c136fc64a0e3", "comment": "Malware payload", "value": "fae2efba901edc1e5ccb7c26d14f999d0fd4b39a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687954537, "uuid": "a6c362a1-fd55-4888-9555-6fcabfaa63ba", "comment": "Malware payload", "value": "400e06f11190f825ff38bc7327e88298180a52b87420daeae7dc0f7f054bf115579ef6d91cdcfa01abd2d736c35b26d7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687954537, "uuid": "33a0214f-caf5-491c-9216-67490be8a11c", "value": "T19066338BB3F10AE4D527807CD4829889E676343707F9E78743B951AA1F53892687FF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687954537, "uuid": "f808debc-d278-4221-a80c-3b2787122ab1", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687954537, "uuid": "1028121c-7489-4242-b181-07a8d23d68be", "value": "98304:k6zTX4Pf1N2zIh3ET9Y9MxVMOPUh3PdWPEUrJY6AOxbHPS2zh/hQqfvsJ1YPwIu/:k0X4FMIZETKwjPePdrQJ/BNOqAYPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687954537, "uuid": "71a8d1d8-f46e-4e48-a924-4ca29b1559ed", "value": 6931046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687954537, "uuid": "f54a20e0-b5c8-4073-a00b-35d453d731fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687954537, "uuid": "3b7a08a1-bd24-443a-a146-1b347e4f74e0", "value": "DiscordNitro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d350ab9-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687987178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987178, "uuid": "e994679b-5ebe-4c79-9260-642a50174d1c", "comment": "Malware payload (AgentTesla)", "value": "af0647b27c71ecd25099615f71519f0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987178, "uuid": "5fa13455-fed4-4c16-bc22-b3213bee6f9b", "comment": "Malware payload (AgentTesla)", "value": "480f481f15179f3009791744f5e16f0fd4868da9b1e68cbeeab729d12f3ddd3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987178, "uuid": "987872e4-6a9f-4996-8ccf-b953aa9e7d97", "comment": "Malware payload (AgentTesla)", "value": "d93145d9a17eeadf660cad5553dbd3563d1887e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987178, "uuid": "e6be54f0-336e-4f20-8fc1-0fddb3f3a21c", "comment": "Malware payload (AgentTesla)", "value": "11f9bd2659c8c04ab688d355acc68acaa44301dcc2bf4fbb58ede79fb6aea93e93ad388707e00eded8067ecfd6fd768d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987178, "uuid": "1ae67885-b473-4d6e-a269-7f6165cfb2c3", "value": "T10AC633145B58F7DEE6A2987569F1010EA3EA71738EABDF6FCEC875101021F84EB2854C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987178, "uuid": "aacb1410-1065-4f67-af95-23f5edc30926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987178, "uuid": "cb82fc57-38d0-4366-a312-9a71af54f271", "value": "196608:yhTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mTrLwyFf6XnhVLc:cTb9epDz4MZZ4RmxYDiScfhHXL1Enhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987178, "uuid": "b22b1f88-ee6c-4026-8146-f737669496f7", "value": 11867136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987178, "uuid": "9f537521-9799-4621-a659-325aff8fa403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987178, "uuid": "83207448-45d4-46a5-ac21-fb3158e34234", "value": "guy1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14ab84e-157a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687932773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932773, "uuid": "03421ffb-feb3-4cb4-8920-1b2ce7eb203a", "comment": "Malware payload (ArkeiStealer)", "value": "781b0834307644f14046dd52d715ce37", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932773, "uuid": "d9a09a28-8fde-42b3-ad65-521a514067ec", "comment": "Malware payload (ArkeiStealer)", "value": "4997b19ed2d5a3e06598efc01500219a1d858eb48d79b7c867842e73466ba376", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932773, "uuid": "865616af-1a66-44f8-9399-ac06d316fd0e", "comment": "Malware payload (ArkeiStealer)", "value": "c3fa9c1c65a6c44cc152315ba70e59a9062b9935", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932773, "uuid": "904c9892-8829-4ff0-8ae9-55618a69e6f1", "comment": "Malware payload (ArkeiStealer)", "value": "0996970b798e0c5bf03bb57a29cfe0e74e332525c1e4c8086662e7d32b7979140e4c1a4d764d78961b215b979d3028ab", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932773, "uuid": "795adeb9-5345-4a21-8d99-1c8be3182654", "value": "T17F948C3392B13C54E9268B32CE1EC6E87F5EF6538E6D77662218AA5F05B01B2D173710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932773, "uuid": "37e98140-25c5-4b89-9e96-9c79f2f6ba3d", "value": "4cb73e7166b3b7d1d1133e9f0d5a861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932773, "uuid": "ee0e0a21-1fce-4454-a341-e05f18b9b8f6", "value": "6144:vS2xgTTGqGioxIqQVhn7rIY8DJ4kXh1JS3/NrLtYGFpjcCmLTUI:v7OTGlTK7jrKJlXhzSBLtYCwf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687932773, "uuid": "918def00-b4e5-4ba8-840f-091ad20407e4", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687932773, "uuid": "aae5fa84-95dc-4543-b851-3a5095e17485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932773, "uuid": "a65f7f2d-9895-424a-91b0-23bf73fb86c6", "value": "781b0834307644f14046dd52d715ce37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37206bd4-1594-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687943681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943681, "uuid": "6deebc0a-1d69-4e92-8ea1-01f137a8e1c4", "comment": "Malware payload (SnakeKeylogger)", "value": "45623e8fbecc3a0db2a6a9e7bccf5321", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943681, "uuid": "6d21da6e-9f0d-4eff-8781-6a53745681e2", "comment": "Malware payload (SnakeKeylogger)", "value": "4a8f9fa6677908329a2943c3bc93ded2c5a530121d28d2bfbf760b1e93b9235b", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943681, "uuid": "c7196b07-3755-4cfb-900a-d9468f5f2503", "comment": "Malware payload (SnakeKeylogger)", "value": "4dce0078224fb9eca0d8b459493471ae3ff17839", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943681, "uuid": "29ac959f-d513-49fa-bbca-b73a4360500c", "comment": "Malware payload (SnakeKeylogger)", "value": "25ea94d07874c6d4b7b6183540292dc62c0eef1cdff73b4a1369c4179a919170b9ac1e36f562e5bb79263d78d0634957", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943681, "uuid": "bf19000e-cd6f-4c16-b589-9f8a441565d8", "value": "T130457C3D2CBD6A37C034D6B98FE5A463F59CC43B3A22993264CB87544746EA225D313E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943681, "uuid": "a504dc64-fe40-41e2-8037-4e6301ec5cfb", "value": "12288:ECXWldJ25/+cNSXq/LpXt3tmiDWkEuZlZ:k25/+cNSXqjpXt9a/ufZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687943681, "uuid": "ecff7abf-e1dc-48c3-bc1e-0fd6e5674d59", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687943681, "uuid": "7cefbafd-186c-4eb1-b882-f35b3a4ac3f3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943681, "uuid": "23a6d6c8-1209-4c57-8ad3-9b4d71bc6f7f", "value": "23-10.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7123e5d9-1605-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687992312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687992312, "uuid": "d2f10efc-cc59-4689-9ffc-2d183748c3c0", "comment": "Malware payload (RedLineStealer)", "value": "c14e1a2839fe93be927bce8994b13ca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687992312, "uuid": "30707ac3-c938-4e3e-b80a-64a8bccbfeea", "comment": "Malware payload (RedLineStealer)", "value": "4bd74d156f2008ef46143cbf817d27712aaf17cafe34bb3dd664d9ef5ae32e64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687992312, "uuid": "5ccbb003-2115-4597-ba85-8199fbb7fa86", "comment": "Malware payload (RedLineStealer)", "value": "585eb48f97f989393f9aef29c6be7eee8b4c2a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687992312, "uuid": "7715857a-c4d8-4352-a03a-ef5db4c2b4fa", "comment": "Malware payload (RedLineStealer)", "value": "452cbadda6ba78943cf5f3f886bb123c3685aad158112c44aab287800062e57b1b1ee78023cb9a62ec3f9f20d247bea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687992312, "uuid": "e3e97a4f-ac2d-4dcc-8c0d-12fb204fbee0", "value": "T1B2C44B61B664EA8BD0BA6178D012896085F1BE166D60C5BF7ED07DEF28F1E81871073F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687992312, "uuid": "3b1ddebb-1830-406b-be5b-6eba5f13d106", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687992312, "uuid": "845b531b-2fbf-47b9-9bf0-a54661788957", "value": "12288:w7Q1/iww/kCGVpz0nQL1fdbRlFHnBd+oN:CQ16ww/kCGVuG1BFHBd+oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687992312, "uuid": "f139c8e4-a226-4f0a-8404-e0a660c9fc04", "value": 594520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687992312, "uuid": "8179e7eb-af45-493d-bc4c-13d054ad07b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687992312, "uuid": "c6a6dd08-82dd-4fdb-a18a-444f936430d4", "value": "c14e1a2839fe93be927bce8994b13ca0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b48e5be-15b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687957835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687957835, "uuid": "770e3ad4-7178-4681-8e30-dec830ddb4ba", "comment": "Malware payload (Formbook)", "value": "a04a812bb027245060e726da7b8ac384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687957835, "uuid": "3a4f0c57-e145-4939-a670-1e1db4b72b4b", "comment": "Malware payload (Formbook)", "value": "4bd7ab79686898a6011d44203b4d8326e6ff6d6db0f7b0a4672bb8efd0dd4451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687957835, "uuid": "aa6383e4-0ccf-4464-bb04-f61c36f76e5e", "comment": "Malware payload (Formbook)", "value": "64dabb1ccbb8a2b6bdcb77663f0fe1ae2e291ae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687957835, "uuid": "d7402207-9d8b-4410-9f02-587b35f3b057", "comment": "Malware payload (Formbook)", "value": "74db71f467b8a29b2074fd2e7b56d5fa5257cc312eacfff205343469535f3758643ff01224c9e1e0f1949e5065050810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687957835, "uuid": "3636e2cb-0388-431c-8b78-82f94cad7d82", "value": "T15AF42B7C24BA1326D072D6BF8FD3F452B678B86A7290E91758C6138A2752B1135C363F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687957835, "uuid": "64d0d793-9d7a-4e24-a605-4ded681441fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687957835, "uuid": "486f09ca-e6cf-4b45-b2d0-a4f3e6c7e816", "value": "12288:u3RHL/NW7msqIq030ORW3a8RJLdiGWiWuhqbTbBAV24AD:u3RHL/NW7msqx0EcALLduBA81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687957835, "uuid": "1a1c1225-22b2-4e9d-a5fd-2116333f97f4", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687957835, "uuid": "f0c73daa-f890-4ee8-ae5f-191cd3160686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687957835, "uuid": "2ddb91af-0d8f-453f-bf2d-c40ea1dcd10d", "value": "OOLU271690625023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a9070e-1580-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687935357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935357, "uuid": "040fde5d-5274-4b1e-beb8-10f68d220aa5", "comment": "Malware payload (Mirai)", "value": "f2bd3627730cb0a7c9bd8daddb3741c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935357, "uuid": "865ffcbd-e75b-48cc-95c2-9937a38d7144", "comment": "Malware payload (Mirai)", "value": "4c6c2ab29fb68ed21312572fb41918235be1697b2f3126c199f2f8393772dd62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935357, "uuid": "07adf2a4-6799-4f5c-9a82-a5ad2d2736d0", "comment": "Malware payload (Mirai)", "value": "586ac69b8ba65928e9435d7b45a28bc422874064", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935357, "uuid": "d8c449f8-81b2-4c1e-8ac1-6a0addece4ce", "comment": "Malware payload (Mirai)", "value": "20859b8be1d9d89f45b08d8be2e2e5cebb05b8e9550dc1760c135d0c976f3e0d5d181f76d797fc0a24c1dde9042cf4fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935357, "uuid": "171eb074-c1b9-4236-9881-525fc160a9b3", "value": "T11E033939B7751A27C8D8A43D26FA431CB2F5064A28E8C71A3E730E9EFF1095079176B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935357, "uuid": "ab86abaa-2826-45a8-8565-603fe3920e17", "value": "384:iWsHGUehhCRQ1neSfj27mZ8fTnYEAzJZ1gdnFp/XLmbMbgwA8zK8IK7FU+pB+ODg:iELhhCRQ1neS6Ydf1ez/y8K8d7O+GOmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935357, "uuid": "830c072d-e655-409c-a111-eb8a03adb942", "value": 39528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935357, "uuid": "9ed233ef-e595-49ac-a448-cbe97b7e66bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935357, "uuid": "df80f41c-38ec-46b1-83e8-170696c5f793", "value": "f2bd3627730cb0a7c9bd8daddb3741c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a6f329-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962610, "uuid": "44b822e0-f440-4ee1-8347-b08c2b98dd1b", "comment": "Malware payload", "value": "84898556446f07cf0fd293d93d710b51", "object_relation": "md5", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962610, "uuid": "86870ba2-41e8-4a78-8e87-79f593ac48e2", "comment": "Malware payload", "value": "4c7f2c17444f07009a936d5db0f1c500fbe8b7ced5a0565fef7df5df039f770c", "object_relation": "sha256", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962610, "uuid": "4ad2bf05-f976-471e-be53-f7c22765fbc5", "comment": "Malware payload", "value": "db4ee2698845d4d5da399ee2b9340e9166fb6e2c", "object_relation": "sha1", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962610, "uuid": "5fcc5410-45b1-4ca4-a5ab-76bab32eac49", "comment": "Malware payload", "value": "f087ce826bca5aaa92dae34a6a68892208b5d422e3af43df7ce34c5afc57d269c28ec60c44f34385fed7932a4dd6ac39", "object_relation": "sha3-384", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962610, "uuid": "68b07e5b-0069-4901-8c0b-7f4c2abde404", "value": "T1C885D042E3CD8391CA325233F976AE256E7B3D3549B0F15F1F88353DAA72262411E563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962610, "uuid": "be1ba083-e57c-4a5a-a0b2-826f8f081459", "value": "fc35a0089284ff9c7c45866438ea8a25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962610, "uuid": "6fc13ccf-8373-495f-b36a-8e57d349f4c7", "value": "24576:94lavt0LkLL9IMixoEiUdtRsu9lb0zX0DkOou268noAgCl3KF4LnPoY:Ukwkn9IM1UdtRl0zX0DkOjz8o1ww4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962610, "uuid": "1b4591fb-0609-41f4-ab7b-95eaec3c15aa", "value": 1814016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962610, "uuid": "cb821d9e-0db7-4181-b48d-4e506305ad33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962610, "uuid": "9403d2b1-6739-4fc5-a014-e75128fe2bd2", "value": "Acrobat.Pro.2023.x32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c280cc3a-15fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687987724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987724, "uuid": "f8e7fd93-15bf-42a4-b76a-9802dfdcee80", "comment": "Malware payload", "value": "4502a6ce10e9e336439c7e8d7dc3d3d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987724, "uuid": "09ff6bf7-82b5-499a-9521-c756de438405", "comment": "Malware payload", "value": "4c8fd012a0c65462e646dd20b88b84be7d5f400d77cb558c51acc6170a0c1d26", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987724, "uuid": "72b40652-6595-4edc-90c0-f32e9add5bb9", "comment": "Malware payload", "value": "0f73bd47cbdaa9c52d06bf1a34a16a03c07a5a75", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987724, "uuid": "dd76598e-943a-4b31-9c89-3e4cd93fc789", "comment": "Malware payload", "value": "4e785d99424062e4fb114f5d4d9dea25d6e57cf5d57da10bfe379739678e45b073adb91f34255a21fa2eb730bf4cb45f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987724, "uuid": "90759b28-01b9-458c-a47c-07ddcb9c085e", "value": "T1BB32D486EE0F6F5FC1D5B038D490F6A105C877A231C78C9971C2EB21F812B61DE96C5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987724, "uuid": "485a08a9-39ee-4365-9c66-92bac3d041d4", "value": "96:R9/FwreGFjG8rBa/8fFqgrXtsCYJ1ZIysyefBKl/1aCVabIS9SfSYjSS9:R9ehY81RrXXmwysyefBG/QCVabs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987724, "uuid": "b9195363-509b-4b77-9f5b-424dec3caddd", "value": 11028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987724, "uuid": "38460d1d-5e55-49b1-a720-b7de039c61b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987724, "uuid": "00520e1b-5837-47a1-ae40-a79cc6974b9a", "value": "Trucking_receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead4efe7-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687933246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933246, "uuid": "aa69b082-679a-4912-aa60-b065ab06010a", "comment": "Malware payload (AgentTesla)", "value": "9e95b32b28dbabc0a4f2574154d8c09b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933246, "uuid": "d53f65b6-e8f3-461f-9006-1c062e0e7b88", "comment": "Malware payload (AgentTesla)", "value": "4ddf9879b1d32f195416e18fcd01e608a54bb24882283b0f36f86354ea2cbdfc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933246, "uuid": "8cd3d805-3011-4f0d-800c-df748d6950a9", "comment": "Malware payload (AgentTesla)", "value": "16c69e35e67caa5a6d9073186aded0cedc267b43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933246, "uuid": "2762c982-b932-4c50-b3d9-d24999d31c98", "comment": "Malware payload (AgentTesla)", "value": "6940f5e9a6d10038bcc41b076d9f8a42db9a66af146eb2f1637ba92f670c8feea858f86535f3efa52f23d0d24ebee468", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933246, "uuid": "31c4a23c-a903-4c89-8aee-5bbe1e53a081", "value": "T18F037D5AE78B02658F811377171B1E89AABDB63EB35141B1346C837433EDC3D42A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933246, "uuid": "738c0350-7dff-4111-903f-f451bb83c03d", "value": "768:fFx0XaIsnPRIa4fwJML3Z9QhUcUMs0N1ESDSv:ff0Xvx3EMtMUa1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933246, "uuid": "1e90a393-aced-40d8-9b9a-e3eead892a2e", "value": 41362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933246, "uuid": "7fa9c395-28d2-4af1-921a-f77f1bfe7e07", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933246, "uuid": "c6143a93-aa08-4c12-b546-97bfa593399b", "value": "Payment 0207.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2770b0e5-15cb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687967277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967277, "uuid": "b524ae6e-bff0-482f-80e2-ab0db7458511", "comment": "Malware payload", "value": "d699bb26d34ae6d55afdbf3cec0174e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967277, "uuid": "77a8169f-0b14-4114-9459-cc7ee95d088c", "comment": "Malware payload", "value": "4e13c9a092b38e7add44ab18fbebc0f6b891d08a4a5d8c17d1fd194e574769b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967277, "uuid": "506311fc-c9ae-4cfe-8c85-635fa124156a", "comment": "Malware payload", "value": "ff36ac57778449d5d0203f5d348c480e43dbca31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967277, "uuid": "8482e921-aa60-4bac-b2b7-ef67aabe63fe", "comment": "Malware payload", "value": "77414e6c22e0c00b293aa0b247d1acedfeee475880ac6528bdaead0699a6f1cee13af6fd6f30771775ea4d93dbd6eafc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967277, "uuid": "97527414-1462-44f3-a723-9055c708a92e", "value": "T1E484BD46103FBB83FA16D9B9E1172CFE47D369109D223EDB045C6D26E25DB7208A52B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967277, "uuid": "ef0400df-74e8-448e-8761-57ef5acd386f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967277, "uuid": "7425147f-f307-4ed6-be3d-aab19aa400fc", "value": "6144:vmTWCHJmBPFWYHdbfjg2Xf9w+ScZWCzYjPvQK2DiA5ePE46guHrUECMCSgZRBWjq:vrzB8ob7gqf9FIx7Q3DluhVSYOta+pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687967277, "uuid": "13a7f368-4a5a-46e5-8d06-4bfb240b3b85", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687967277, "uuid": "5bce4399-ac7f-4653-88d4-01358d6e5f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967277, "uuid": "d9dd9140-baae-411f-80b4-72684f13c95c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508537d4-15b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687959186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959186, "uuid": "02e80d81-b394-496e-b3f2-b3747b613a92", "comment": "Malware payload", "value": "94686c14fbdc75a30ae25da2f44a082e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959186, "uuid": "989e2720-6f92-4c5a-a465-efdcfecf59c2", "comment": "Malware payload", "value": "4f1b3ea7148482add0330eea5e504ae2894e5cf34381526115d940275af69f1b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959186, "uuid": "abfdb2c6-f5de-4c89-a3ea-ae32216bcada", "comment": "Malware payload", "value": "6d8594e9e79fd7e56729060c6952d9e5aa5283bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959186, "uuid": "e3cebcb2-b3ed-42c2-a059-abdfec752723", "comment": "Malware payload", "value": "75a938d123d42249975d643642be58826e619f05c5e54ec7ed425a34f0bd6a84852d0e8dedc08e07325cc741254d3797", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959186, "uuid": "e930bcdb-f439-4891-bdfb-0ec927e6d541", "value": "T1C122A7764B960972C31249F861BE6A0759FD5A0647C959E3CFE00C0EBCA43E72D32AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959186, "uuid": "07d84ddf-c9e7-4996-85a8-f6825bcb65e7", "value": "a1abab4459c07e768c7c2de6cb1dfdea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959186, "uuid": "f5193c16-077b-4c52-b9d3-ea022621fe42", "value": "192:2KMzeAvxnWWI+1H53yoncQWHDy+qfaSdCwzYKoJcz:2KMzMHAHXuyDiSdXcRJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687959186, "uuid": "76efddca-e991-4f9d-89b2-78f7ad56ad18", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687959186, "uuid": "81491311-5464-433b-b66f-430621537c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959186, "uuid": "9a248685-81f0-4b8e-8ff3-8fe94063e0c8", "value": "SecuriteInfo.com.Win32.InjectorX-gen.13904.23751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33648bc5-157e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687934226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934226, "uuid": "c70d3db3-5450-4c49-b048-c59cd2b8c86e", "comment": "Malware payload (Loki)", "value": "54b02241f238bdf0e289f37bdca948f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934226, "uuid": "d10fd496-b729-45e9-9e02-8d286006ac7d", "comment": "Malware payload (Loki)", "value": "512e4f1783f9dd5aae8e6a8fa3489845481041884984b3f30f59e95de7ffe0cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934226, "uuid": "ac8e52d6-42e4-4707-a8ff-8da14d2df96a", "comment": "Malware payload (Loki)", "value": "0ae56ef304e69a0b72b5bb50a2465ff34ebff1f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934226, "uuid": "fa77c689-e2ac-4126-a705-e13442b0b7b2", "comment": "Malware payload (Loki)", "value": "aa3b7a4d24ecc76529704a92989cfadf8023f72c63eb4098d026fbd6752b362bc446aaa052e09ce0a50d46b265b9441c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934226, "uuid": "e1f6dd62-17e4-4eb5-b624-543d02f15c5d", "value": "T1C2B4120063C220A6CD5608BB496701790DC5AC0799C55F93878D732E7E77A8AFD9FABC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934226, "uuid": "fd652119-0506-42ea-b670-b6d42d1f8fdf", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934226, "uuid": "bda60f80-49a7-4672-b69b-e9185af1a2d8", "value": "12288:9FKBG73lOUG2H7zS8zjDcec1LqlVAY2BPa7Xd:BrlMa7zbzPcZZON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934226, "uuid": "0f46eec7-7668-491e-8e8c-61485a3b9a35", "value": 515133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934226, "uuid": "363173b2-6448-422e-be64-070a1b44e628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934226, "uuid": "f8d5b775-db1e-4453-813c-2bb03ea49ce1", "value": "54b02241f238bdf0e289f37bdca948f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4921d36a-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687963039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963039, "uuid": "0dff6236-5f6e-4ef8-80ce-96a01e6fc56f", "comment": "Malware payload (AgentTesla)", "value": "7e7adc1ebe10599be97efcc9901a100d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963039, "uuid": "3cf7cbf0-b036-4957-9af0-b27ce59c2862", "comment": "Malware payload (AgentTesla)", "value": "516b951cc8f8510145ee20df40652adf83b989c909773a2b0ad0c6123f388854", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963039, "uuid": "04fcb273-a69c-4b82-b61d-b3a8246ccc21", "comment": "Malware payload (AgentTesla)", "value": "64d273709c386826c015a5af26f20b56902dea7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963039, "uuid": "44bc923a-5056-4cda-98ca-d0b6f5bddc46", "comment": "Malware payload (AgentTesla)", "value": "f4a073c14be7d75ccb62ce58671923f5b06235e719cbb093668726823f62488220d12ba4092e361cbf9eaabcc78b8784", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963039, "uuid": "cab06f3e-2726-4624-b022-f3e2345fac4c", "value": "T117B467025EEF5108B1B3AADE5BF540A84F37B9755939C15D008E290E1BEBE80B961F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963039, "uuid": "b0442ff0-1a1f-449d-bd8f-0af63ba1ffa5", "value": "12288:QSODxHfObi5T5M5S595N5/5r5j5Z5Y5M5b5X5n5b551e191SPMxzak5:wNHWiMxzak5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963039, "uuid": "6a8073bd-749e-4406-86d1-a3360c7fc428", "value": 497998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963039, "uuid": "17693279-a4ac-4813-be2b-3a28d0db011b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963039, "uuid": "a451eabf-fe7e-4cfc-9794-13834bc97209", "value": "New order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff82dcd-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687935670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935670, "uuid": "a91fdb2e-e4b7-47b2-b26f-4534db866bc4", "comment": "Malware payload (Mirai)", "value": "8ee9555ed7696f519eca9e496485203a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935670, "uuid": "0e0c1e2c-2cba-474f-8985-40f212667c80", "comment": "Malware payload (Mirai)", "value": "56fe3858907c46ba1e550cf122afed468aaf60c85bff9b12f1aebf4031e9ae83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935670, "uuid": "e8d83691-88c9-436e-8d92-b1fa4cf73b3d", "comment": "Malware payload (Mirai)", "value": "cc5eb7da4bb09a243ae113ccff4dbdbbcc945c61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935670, "uuid": "a5dfca5d-450b-4732-a913-a022c3e2c8ea", "comment": "Malware payload (Mirai)", "value": "2635e2a2b1d4fdee3ba1426e5b73d3faa241db21c2e9d8929d4c1da8d3f6cf8279bf90beea45a1a59f3f8e7ffb847ac8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935670, "uuid": "0813a907-d921-4d36-996f-0f3df0fc4688", "value": "T15BE21981B22D0847D4E72EB0357F07D0D7AFAA9220A4E389760F9B49D571E379907D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935670, "uuid": "d9bc1a71-e0e9-4d62-a3f6-c08595402e35", "value": "384:6St4aS2oWuHYJTerFIezUhfjJzytcmmNZgaxN+DecgxNaHhz5z21v25VZ1/l3N4Q:W72Hu4RAX2zKX8xziHF75f1/TT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935670, "uuid": "496e6a1d-cd97-4769-995e-d93a01aaa8a9", "value": 34168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935670, "uuid": "78686457-4f8b-4eaa-bbd8-bb0edac621a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935670, "uuid": "d0e267e5-dc77-4fe4-a4d9-3f9f83836e01", "value": "8ee9555ed7696f519eca9e496485203a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee00dbee-15b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687959880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959880, "uuid": "a7f4178c-9431-41de-b7a8-de8d3efd96ad", "comment": "Malware payload (njrat)", "value": "87ee32efbf48d6cd6a12d3de30527bdd", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959880, "uuid": "a24caec9-78a3-4be1-8727-c14f19e02938", "comment": "Malware payload (njrat)", "value": "590a2ffe3a7d94ea6f13f48c39affc97790afcad1d1f750144e6319ace0c42a9", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959880, "uuid": "ad483d57-fce1-41ed-a689-22727400b274", "comment": "Malware payload (njrat)", "value": "b895b0c395ab5484e66472e6ecd6290ff0fca48d", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959880, "uuid": "cc885c94-1842-4426-95db-d42f1c41dce6", "comment": "Malware payload (njrat)", "value": "16b675421fa0b3acb2053fe067922abeb2f4c4b2fb1fb5c132811ea8c2dabaa95b024794a028996cafc354c2ceaf5a49", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959880, "uuid": "9b96b942-504d-49ec-aaca-d423315694d1", "value": "T17FB46E025EEF0008B1A3AADE9BF645E44F33B9755939C55D419E190E0BEBD80B861FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959880, "uuid": "320f88bf-2945-425a-a611-7470544154ea", "value": "3072:KRr+dxPr+9gr+Ejr+gMSlctO+Jxq3udcXryOXzRn/u35n5p5XNsn1+7HLDVZcMxz:blRyODRn/umn+AMxzak5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687959880, "uuid": "8f048bee-6d42-425c-8961-3c9085fdb87f", "value": 513178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687959880, "uuid": "eaf2dfc3-64ab-4e5f-a30b-5c9ff97c06cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959880, "uuid": "2ac0f7fd-23bd-4490-9d32-0f2827a47983", "value": "gorbra.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f65eaf3-15f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687986135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986135, "uuid": "95b45dd3-bed0-4edc-b85a-492432bf4724", "comment": "Malware payload (RedLineStealer)", "value": "53b42ff4db43ae3af0f274441d584043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986135, "uuid": "8023b925-704f-4b87-8513-cb6f3a11e7dd", "comment": "Malware payload (RedLineStealer)", "value": "59a894ea657c52488e4d0b1b5a67988ca4057e9be7babe3e2d67a85e8267a3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986135, "uuid": "dd893dc6-b902-42a6-9384-bf541079e49a", "comment": "Malware payload (RedLineStealer)", "value": "ec9ba2e7777ea229d01770e4c08f21df54c8e5cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986135, "uuid": "81fcb131-f431-487c-8ac9-3a69dc0f4995", "comment": "Malware payload (RedLineStealer)", "value": "389c2905fea695aef762713992f1fc023be132323cafe55bd719e9571ae6928464593f2e903632ab71e8d33570bae527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986135, "uuid": "0d6b6347-3944-4244-bf17-6f34db1bba50", "value": "T1A825CF8D1E2FC92EFF66B97C85D4C0E26D4C9BFF44F148B63684C667678296404A887C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986135, "uuid": "36302f65-0c43-4db9-8f7c-552c1c1bb11f", "value": "a95574c9913dbea82b8cba27ffd5141d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986135, "uuid": "8df9841d-c506-4833-8b7b-4d25df831f94", "value": "24576:Fa+znSKeh1sLVVQb7/S9g7Q1Z6P8xmfX3ehi/AOiAUQQ:kIOgTJG7zUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687986135, "uuid": "2ae16fe9-950d-4ca6-b98e-6a38f95151e8", "value": 1021064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687986135, "uuid": "517a7e7c-ac0b-4e8b-9a78-0a577e2870e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986135, "uuid": "81804c36-16da-43bc-bef0-086a5c992e5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b84492-15df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687976032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976032, "uuid": "aa7cc67a-d568-4f91-b993-011fc2b45f54", "comment": "Malware payload (AgentTesla)", "value": "fbda10e1774127bd9cfb8d0ffe21e30d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976032, "uuid": "0d2adc34-f1a7-4cfc-b5e9-893164a85cbf", "comment": "Malware payload (AgentTesla)", "value": "59b8b1bc8f30ac348c881d4773384138d358e048e4d40b4f412daf7323aed903", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976032, "uuid": "37f35579-fad5-4b5d-852a-40198e77f232", "comment": "Malware payload (AgentTesla)", "value": "19b987072ad38eb4e897f6e76faa98b699e8c707", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976032, "uuid": "bdcf4c12-d9b3-40e8-98da-6f48f707f0a3", "comment": "Malware payload (AgentTesla)", "value": "2ef5351b01c22573bacf1c1e41317b206e01a51fd92497e63d13701a063958c8e6e7900155985cfa825d7babccec8dc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976032, "uuid": "e4890d7f-918d-4437-9808-d2d33845fcae", "value": "T10045383C18BD2B27D035D7F98FD48023F2A4943B3922E92669D257D60756F9229C723E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976032, "uuid": "1d207078-ec0e-40fe-bccd-5d5c2ec79a2a", "value": "12288:8mR1lVaOllJ4LZLNgTvXQPyCTVA4XEJ3WSF0PtwcZWPM:xVaOllJNTPEUWSGXWPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687976032, "uuid": "d948fd43-2658-4251-bad3-9f429368e3e7", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687976032, "uuid": "509addf1-47e0-487c-b10e-18ca9b377eec", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976032, "uuid": "e547976a-7d26-41c7-85fa-f1e50ea34251", "value": "nSolicita%E7%E3o de.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782c2553-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687935630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935630, "uuid": "67030c00-02cf-4771-b83c-b5037e89c0f4", "comment": "Malware payload (Mirai)", "value": "2c9cd97586726f507f1d47b218f68e29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935630, "uuid": "80d033ff-7b88-443f-a904-7814d8812313", "comment": "Malware payload (Mirai)", "value": "5a90be0546a9efaf6bd1722d627427dcccd87af8d2bb6a83056768953f449cbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935630, "uuid": "3af831cd-fa48-4288-a1ca-72aa7ee097ee", "comment": "Malware payload (Mirai)", "value": "cfc7af6e8eb0a4d946286b37f6f611c4b280a224", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935630, "uuid": "6707d616-db77-482a-b0bc-30608113620e", "comment": "Malware payload (Mirai)", "value": "b3ea0e6787a93e624fd0e17e59907dee8ac668416cad9d370e58d7ad37f26664f468b24b4dfc174c12ccedbf8663b2e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935630, "uuid": "19b65434-4186-4369-874e-dada00bad78f", "value": "T19123A40A3E658FEDF76D863887B78D21A758338216E2CA84D15CED005F6034DA45FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935630, "uuid": "3fbdc433-6b51-48f5-8ca3-549b7f010b91", "value": "768:lZE/WNINoNMW+WWcX67Qq4a/S6St4jyu6EWXxhHatuPLsu0uBtu7tuauQu8Agk3c:AeyiucWrtSt4eu6FHau4aTyIOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935630, "uuid": "21280ac1-c976-48b7-9618-ecb0cb7591ca", "value": 48680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935630, "uuid": "f075d689-cc90-4e90-b58a-4f9a6f58b17d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935630, "uuid": "7ffccd13-d689-4c46-b84e-3ecb57f603a9", "value": "2c9cd97586726f507f1d47b218f68e29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c50d59b-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962615, "uuid": "30c72b94-4ec1-4d1c-bd90-55d0eded3e12", "comment": "Malware payload", "value": "09389ae5f9d3974821eef72fe9139f39", "object_relation": "md5", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962615, "uuid": "43c592ef-8a06-4bef-8a33-c978ab9defbc", "comment": "Malware payload", "value": "5b317b90959b117fde4dc895076ee8362f71eff73e763ad04719a6c40c347500", "object_relation": "sha256", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962615, "uuid": "654c1f3a-b6b4-451a-964d-8e9cfe8f01b9", "comment": "Malware payload", "value": "d1a501468f7798c58e0d5f36a9318bf81696fe73", "object_relation": "sha1", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962615, "uuid": "de210f0a-561a-45f6-bb08-7e7f38007720", "comment": "Malware payload", "value": "f33d84607cdea9b2169e79d5b5fc306aebf82474ec44107fc9c36504e1249e8b7ea25517889301c6c71f30dcfb971b36", "object_relation": "sha3-384", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962615, "uuid": "ac401e2a-bcb6-44f4-8429-013a05a51e11", "value": "T1B2112039733BB8A68C0D0170420DDC98972AAE8533478F21394D6EBD4FEB19D8C9C5E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962615, "uuid": "1e8278ec-7df9-47ee-9f41-1183ce6a3800", "value": "24:YF5No84i5xMaDMPfHy2hHf/N4xs4H3xKpU3BcRXkZZ1C12BH:STo84i5xhaHy0Y6pUykC12BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962615, "uuid": "7fb8fff4-8466-4f2d-8ac7-9a85acb69a7f", "value": 1069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962615, "uuid": "dbc36b38-be0a-4bc5-98f8-08c844e6bce5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962615, "uuid": "861b03fe-edc4-49ca-b6fa-21187701a8a1", "value": "www.adobe.com_.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8ff9db-15f0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687983444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983444, "uuid": "6d9051aa-cedf-4a54-88bf-47d7d1626f1d", "comment": "Malware payload (Fabookie)", "value": "99fb11d82569a087ad64101af0de80f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983444, "uuid": "4e652e77-8337-4bc4-a600-215823cb2616", "comment": "Malware payload (Fabookie)", "value": "5b8e096d71a9cd1a4847871083e473b2828eb2aabe0acdba82e722d0bb2e11c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983444, "uuid": "930e95d8-b49e-4bcf-81fd-9c8a54eb9439", "comment": "Malware payload (Fabookie)", "value": "aacea1e9a73ee15f94565a8a4bb5e69367da19fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983444, "uuid": "98ae6cfe-c924-42d8-bbba-c68fff11c526", "comment": "Malware payload (Fabookie)", "value": "cc537e1940ff4b54f96913ad28b215f2a7450735af6d411619a8bb6423e25e9c667bbb9fc15346a98d91fa7da6889c44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983444, "uuid": "662fa0bc-e1a2-4e1a-bb4e-63ceb9eea7f3", "value": "T1EC643C156FB91CB6C017B43F0C6E84524B337827166783F7A496DEAC0EF76E8D466822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983444, "uuid": "0f173c8c-2c70-4d53-adf9-fd785235a841", "value": "a7a19cad0c2c193feb43fc00c1b6b502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983444, "uuid": "3f23e752-b24b-4167-ab58-fc619d3cd675", "value": "3072:E8kUTMYQ0qIN6NtVcOXVK5UMJ2LUPj3keyRS6CSfKVu1xgCAWU8fvJqxEm4x1ES1:DMnt3VPCJPjsp/1fvoxEvTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687983444, "uuid": "b2dcb37b-3993-4ab2-8aa0-32369b51839c", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687983444, "uuid": "a71d504a-4990-446d-9c0e-ce2eb771373a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983444, "uuid": "8f4bffed-2aba-477b-a8f6-593fada8118e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0f1617-15af-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687955610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687955610, "uuid": "36531e13-8006-46f5-b13c-c666ac6dd640", "comment": "Malware payload (Loki)", "value": "cc405078446d5ea6ce484877138cb735", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687955610, "uuid": "b8dc7198-8e03-4981-91a0-b37625a323fa", "comment": "Malware payload (Loki)", "value": "5c6cc2867e0257627d62b4af6e6dd845321e31b383b26796fe82db3a8636ce91", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687955610, "uuid": "456403f2-4471-4084-b0a7-5ef72b61cf02", "comment": "Malware payload (Loki)", "value": "aff96898f713888fc18d843729e3350f697ef8e0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687955610, "uuid": "65205565-1ba1-41c4-a910-4c802c179d04", "comment": "Malware payload (Loki)", "value": "b3f7da180a68c425583f2fce376df4bdea6f95aa24ee26f115460dc925bb66dfd18c761db9ccce4187f6d8e2566e9d60", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687955610, "uuid": "757cfd5d-9e32-4a97-ba83-8ac90a5d3713", "value": "T1BCA52319C741682BF54F06B2218A5896831DBCB33948DC423A5D366F8776F70DEB3A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687955610, "uuid": "a422ba39-f56d-437c-b518-64ed95c4c664", "value": "49152:djH+MXV9Qp/in668MXxN757J+MXV9qp/in668MXxN757edNYKf:IEvyi5HhN79EEvEi5HhN79ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687955610, "uuid": "e375c253-a925-4d07-8860-1491a181f26c", "value": 2187776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687955610, "uuid": "d12b439a-c4a5-4e86-afbe-b96ac2452daf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687955610, "uuid": "30831bf5-bf97-4fd9-865b-195afbf1e639", "value": "DOC PO155362A.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23077233-15bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962116, "uuid": "de048254-be33-465c-871b-d9f7c7368ab7", "comment": "Malware payload", "value": "0d7f65115b7ac9d7503a28af1266399d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962116, "uuid": "6f255399-2d69-484a-99e7-4bd3157982d6", "comment": "Malware payload", "value": "5e273d27c320b4ba9da91dedaa66ba91cb6ac05fa2195096a2b85e9954e981c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962116, "uuid": "80e9287a-bc74-4c2b-bd8e-f3684a8ed57c", "comment": "Malware payload", "value": "48e7676a658dabaf14bdf70a62435e2a9ae90203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962116, "uuid": "de089e2c-de67-4107-bb2a-d0137c656849", "comment": "Malware payload", "value": "3b61be3722a7b8f4174e7132d85fd3c95fb64269d2500b8880377653f5d44e92e4f25888f942bb8c941df98e966a3ecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962116, "uuid": "39f7de2f-1fd5-47da-ae65-9904d15cd837", "value": "T16FE49DA09AD81194E7F57838F395BC5F6DFCE123BC096FF23B9980F6BA89100C665215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962116, "uuid": "c6ad102e-f393-4ed6-9d48-3ca17a0f2591", "value": "6144:gXovsDHYdtCtMXtJxnrr8qjjRT3hihC2X5ph3q5Yap8exbx8xxYXXXXXXXXFpiiw:wQAMC+bZYej9Wzh3qBIin+x5dPHoO9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962116, "uuid": "44924851-3de7-4af8-9950-c3791eadda3b", "value": 691728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962116, "uuid": "5d2963b0-1618-4ade-8748-cdfafab5db28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962116, "uuid": "584a00cc-9595-4d11-adb7-4ce3ea145da5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a446d2-1567-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687924452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924452, "uuid": "fe9dfce4-d85a-48f0-87aa-f38e5b1d0bb7", "comment": "Malware payload (RemcosRAT)", "value": "a9d3574af4554b1df3cb1f4c8031b665", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924452, "uuid": "bd19ef34-c509-4c67-8a54-33a7c327ac07", "comment": "Malware payload (RemcosRAT)", "value": "5e95168687b15de3724b3c8240c0b40cdb61c75b440d11a7fa72c2b247c920ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924452, "uuid": "0b25c1f7-76b4-4660-b1e7-e00249f21265", "comment": "Malware payload (RemcosRAT)", "value": "e86300a0d67f3f0370c7201d483f82a95192754d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924452, "uuid": "de7df14f-ffd8-42ce-9db3-a78255063616", "comment": "Malware payload (RemcosRAT)", "value": "4f58c7fbaead2a3722da631775340cf6e86b29af81b7d6f3ecbad50379290cf7bb48b21082b5a98a0b746c7c73357a40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924452, "uuid": "25ed7397-24c9-425a-ad9f-8e8cd6f5e266", "value": "T18815BD3C19BD2A37C174EAE9CFE48463F150C43F39229936A8D787954756EA225C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924452, "uuid": "04d2a0cc-d488-4004-96ff-91668c0d63e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924452, "uuid": "1817f476-f23c-4279-a189-3b5bbe39f440", "value": "24576:EjqWyZoqg2cGYFP6yVDq8a1jAcyN9BYoaVVs5rR6xgZC:ETSoqQTMYIovV4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687924452, "uuid": "6c03a473-cf00-4b6d-90dd-8b1bef7052d7", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687924452, "uuid": "489eb92e-5b6e-4bc8-b241-3d401b8c457a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924452, "uuid": "09b02103-0d8a-4057-bea8-acc5b9f0597c", "value": "a9d3574af4554b1df3cb1f4c8031b665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc3aaf4-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687963340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963340, "uuid": "6b6867fc-f5ed-4f24-94e4-e87a2b646c8e", "comment": "Malware payload (AsyncRAT)", "value": "fd56a352d912453b3f06fdb6a7f46b68", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963340, "uuid": "cb80b18e-0a33-482f-b6ab-1ff16f4dd958", "comment": "Malware payload (AsyncRAT)", "value": "5ee56307c6fc01f08cf1c73c8770f137d9e91d993e8fab9a66463c411d1b3523", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963340, "uuid": "827569c1-4e18-407a-917f-8f2c0f355e3e", "comment": "Malware payload (AsyncRAT)", "value": "69a6b0022f3e929776fcdc627efb7965c92fd1e4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963340, "uuid": "a5ec39e7-27dd-4d96-b8bf-343e01332c49", "comment": "Malware payload (AsyncRAT)", "value": "4005e38019ad955841464327b48a32f4f3b556d07b76d2e80c155fee8a2ccbd85dbec3a026231f6aebde28599b24ca97", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963340, "uuid": "6a564c67-b7cd-4e5c-b42b-c3f8ca3959e5", "value": "T1ED04491437E81919E3FF9FB9F4B002258BB2F823A517D76F189458EE2D62344D950BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963340, "uuid": "c7c3c60f-b048-4283-bbfb-759959c007f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963340, "uuid": "ea8c9e8c-1212-4587-8214-4265247e3ddc", "value": "3072:S+STW8djpN6izj8mZw9900qX2lD9PvWqHPu/i9bxJ2cT9WM7HS6+WpP:P8XN6W8mm997lDhOGPSi9bfZwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963340, "uuid": "1bcb30a5-c5d1-47d2-a7a6-74f9cb7d4d4e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963340, "uuid": "e5597968-5409-452a-873f-871792106678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963340, "uuid": "5b94cf9a-5294-4c31-93f7-1963c619b158", "value": "fd56a352d912453b3f06fdb6a7f46b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a58cea-1586-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687937632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937632, "uuid": "4e0800c2-75c0-43d8-8bc0-4debf6d0798e", "comment": "Malware payload (AgentTesla)", "value": "1e006a0791f0b091f3d7fde899a39854", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937632, "uuid": "3280814e-5966-47ea-9c70-acdf8519fd5c", "comment": "Malware payload (AgentTesla)", "value": "5ee582d1bd84073667ed3efac6913e24e08e522234edeb3453d8cfe64f655127", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937632, "uuid": "95519608-47b4-4d93-9085-f87177778b17", "comment": "Malware payload (AgentTesla)", "value": "6dc80dfe634f6dca07979d525beafc25947df918", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937632, "uuid": "e224af06-c445-4649-99d8-a78eb9086fce", "comment": "Malware payload (AgentTesla)", "value": "12dacb618fff8fdf17ae566d164c2ff1d3f67b7bd3f11fbb5663bcb1601fc721058b05753f8791fb94671a50d5502017", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937632, "uuid": "5925e922-3d1a-4148-b029-a35234ee4814", "value": "T1179423A4DD16A40FF53DE2159A4E5AA5D2C6C4EA8C4F1D2A80AB33C0BDD4B20671C5DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937632, "uuid": "79779a43-78e5-4456-8950-e35984e468df", "value": "12288:w0ifBlEPnPYFsaO2Oajf+2OdmOJk/fRsOZHnWFQo:w0ifSnPYo2OC+2OdvofRssnQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687937632, "uuid": "91160363-649c-40f0-a4b5-1b1f573593a3", "value": 432338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687937632, "uuid": "0c5e9441-f9d9-4bd5-9821-ff74f98884dd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937632, "uuid": "f16edcc4-79b4-4765-b549-6aa4e8a7c900", "value": "Invoice of 53 Flights.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269aa459-1583-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687936352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936352, "uuid": "9d50343d-a4ad-4c55-9229-07949d682bbf", "comment": "Malware payload (AgentTesla)", "value": "5f39c0d1346463737e64f05234f45a5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936352, "uuid": "a31ebad8-ce5c-43f0-984c-6698e96f3f39", "comment": "Malware payload (AgentTesla)", "value": "60688f7bb0065eb15a6c18f0a612bd95ecdf51dbbf72660c44a23cad2c1513e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936352, "uuid": "6edf7886-0d08-44c8-b70b-40b4fbd358cb", "comment": "Malware payload (AgentTesla)", "value": "d99c2779646674e8891fb1e740e94e8fa2ca23f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936352, "uuid": "9dd3bc2c-45a1-4186-b696-70c8df259eed", "comment": "Malware payload (AgentTesla)", "value": "45dab4901a5a8cac4284923f7d08fc58579ea9b26f6da4dcbe78c928bcf9dc5cbbc89e164e0201f8fcb57b3dc214e024", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936352, "uuid": "24148f29-9f5a-4e30-8589-964285aa4c9a", "value": "T124B423B33C1345BE1E186AB9BDF7DC64954B3C6E641606DFCAB0026C82BA78B85CD047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936352, "uuid": "e6c58f9e-b325-4613-b320-194539914683", "value": "12288:JSJHeoCA309qq657GcjZaew9088g8FHdzHde7phrJEeKqwy4:Q++3Pqq7vi908dedz9e1Rgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687936352, "uuid": "2af4b2de-2555-47ba-9070-3ca557fc2a3f", "value": 533866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687936352, "uuid": "9623f9b2-b962-4754-867b-539d7776dfba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936352, "uuid": "edd8ef68-3233-4938-af3d-a22a4b4cf77c", "value": "SOA FREIGHT SLIP-223478950.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2287a854-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StormKitty)", "timestamp": 1687962974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962974, "uuid": "d193f618-088a-48b7-8bc0-32880fc44982", "comment": "Malware payload (StormKitty)", "value": "563105db91d8994ab88f7d73a64ad368", "object_relation": "md5", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962974, "uuid": "ae83ff5d-fbef-4ac9-ad33-62e57f95599a", "comment": "Malware payload (StormKitty)", "value": "611240aac244644d45c51422581837adea4624f130a238a4742646e83aa70c03", "object_relation": "sha256", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962974, "uuid": "4c196ab3-8524-4295-b799-ebd6c83145a3", "comment": "Malware payload (StormKitty)", "value": "bc9342d184d8e994bc971555c359435750a6fafa", "object_relation": "sha1", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962974, "uuid": "190e70c6-d51f-46d4-8553-f404f6769950", "comment": "Malware payload (StormKitty)", "value": "dc827ce0a30f413f0783cb51a7029d9850ddb972ceb7b2336585b4b4fafd19a0a919ebff3decf28fb8c38fe297d9cc02", "object_relation": "sha3-384", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962974, "uuid": "6fcaa60b-3345-4390-8be1-e90eca9fcf70", "value": "T13216ECF355EDDFD6227D3D8B371C0BC84DD02642958BF85BA395D58A02C8E80DAA9E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962974, "uuid": "70969d4c-7d18-4774-b12e-2b62d0176f88", "value": "6144:wocsGPLYBciclsEveCx0ewEvagIXOJl8zjmQagZTR4RQlLCKqshj4Bz78i7Dlxr2:BcsGP8BciclBeq0envagfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962974, "uuid": "8a8f05fe-7655-412b-850a-3c35dd526eba", "value": 4048480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962974, "uuid": "aae76fe9-760e-48f0-810e-059d807f94e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962974, "uuid": "e3d884bd-1247-4051-a341-e16ec1e82fc8", "value": "PI 74995.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684fa566-15c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687963950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963950, "uuid": "f00dc164-8718-4ba5-a5e6-f25cb01efad7", "comment": "Malware payload (Formbook)", "value": "d14a91aa57d07c025c41acacb012c819", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963950, "uuid": "58606129-303e-4b9c-9b8e-5dc65537c8ca", "comment": "Malware payload (Formbook)", "value": "62d79b7612daa665c7f2769bad890f7d42fc26849f0baa1c596e601b0a724057", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963950, "uuid": "327fc037-b32c-41bf-96d6-4730aa71f900", "comment": "Malware payload (Formbook)", "value": "1663382a14d6eb3108e9520d21dea5026f72b5ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963950, "uuid": "330c4c02-662d-4b12-b00a-42c060a88914", "comment": "Malware payload (Formbook)", "value": "11663dc3cec8b88e81e0431ac62742aaa10b6a03c1e05fe35563f9b961f062e8380a4cfac2ce0b9125b98e550ffade62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963950, "uuid": "f118745a-8724-4e55-a247-34182bc105e9", "value": "T1DCF4183C6B7D9A22D034C2B5CED584B3F2558F3AB411D523588A7BB52762B921DC332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963950, "uuid": "134227de-4dfa-4986-b914-e51e545addaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963950, "uuid": "c2ad03d7-8086-4f83-9a55-d9983fdeeef0", "value": "12288:6cj6XyQW4TxR4ApCjB4iGUjQZWKYOfTHo/NcMWhblx0Ps1+py:X9B4H4AYt8iOANcVxf0P1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963950, "uuid": "47b731fc-0983-40f9-9bd9-165f79ef306e", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963950, "uuid": "2b8329b6-34c4-4f74-ac0a-646b0df7b80a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963950, "uuid": "f4aeeb62-2720-43a3-8ef5-5a9c94c403f2", "value": "d14a91aa57d07c025c41acacb012c819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054132b0-157e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687934149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934149, "uuid": "48fa6a07-c03a-4687-be04-716eb9cc34b6", "comment": "Malware payload", "value": "1a36dea047905719e58ab4146b562400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934149, "uuid": "61821b9f-c43b-4d03-bf32-1ba3229f3357", "comment": "Malware payload", "value": "634b9018abc756f4ddb1260838889120445f778f294f435790ad6b72a6054da5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934149, "uuid": "5cf28292-b621-4220-83fc-5ea17e38bf90", "comment": "Malware payload", "value": "d75e3cc949cb3453c7e678bc602f5401ee8d26f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934149, "uuid": "f54805b9-da10-49a5-bd3a-a7f2d2eecece", "comment": "Malware payload", "value": "dc4bc832ab4603f64edf9c8548a4c48166df147ebbd6a8b0335de682991de4c9755ab89d79fc5a7ed15606a9c81c0b5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934149, "uuid": "d676ad0d-7e0c-4fe4-8a80-c171ec9ec86b", "value": "T15F839D2175D0D032C4A329709934C7A26FBF7D6127B895CB4BAC18396FB07C16B7939A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934149, "uuid": "a1a966a8-2929-4b3c-8150-6c969e7d894d", "value": "1536:Pp1M6LoGbS81TMsUavKRuuaHFP2tk2nK3FRmbEZGPnc4:Pp1po6S8mslvK84cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934149, "uuid": "a68c62da-54a1-4198-bf50-c1e40dd4b4f4", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934149, "uuid": "62830b52-e48f-4667-b7f9-8529b07bb592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934149, "uuid": "4ac2d9cf-4a11-438e-85db-0c382a92177a", "value": "1a36dea047905719e58ab4146b562400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5168f85d-15b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687959187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959187, "uuid": "ed851341-35d2-4428-a675-eb0687dff6b7", "comment": "Malware payload (Formbook)", "value": "ea454de96f2ea7d7526f7989ece67dfb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959187, "uuid": "b6ceb253-466c-4354-b1b6-41170860e2c2", "comment": "Malware payload (Formbook)", "value": "63dd4c9e310e623b09458275747e991448e703bb3fd1160aaa481a8fbcd7a516", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959187, "uuid": "2cd1568b-4456-4ee4-a826-59aa11299179", "comment": "Malware payload (Formbook)", "value": "9811cfd93c9412a56437aadb0ddb79e43698392d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959187, "uuid": "229ea9d9-a901-4465-bab1-c6ed5d435773", "comment": "Malware payload (Formbook)", "value": "4d44c315ea12ef4c53cc60fc9db1f4eee24fee74f768e912355f60084d484571557febdae42bf82376460048a6e3153c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959187, "uuid": "8ae34f41-c159-42f2-8d37-dc8f43898437", "value": "T120D2805AE79B02B84F511276231F0AC9AB3DB12E735154B1386C937433E8C7A4676AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959187, "uuid": "525ea255-0527-4c8a-a7a9-239b092913c4", "value": "768:kFx0XaIsnPRIa4fwJMwaI2L6TYAQ8GiD9TZ5N+Tt0UR:kf0Xvx3EMwV2kYtio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687959187, "uuid": "9e57e4d2-7b56-46a8-b2e2-9fb71c1fae30", "value": 28593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687959187, "uuid": "c6135bac-5642-4940-a6d8-390e61c648dc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959187, "uuid": "73ae917b-4c55-45fd-b1db-d2facb9e0c90", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.8599.10276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef557a02-15e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687980498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980498, "uuid": "d7f47f49-78a3-48df-9c11-b886673a7c81", "comment": "Malware payload", "value": "9cd5f6a540967b0c453bb5cb1ae7d503", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980498, "uuid": "f063db92-3dbd-4bd3-97c8-ded5fa0e6fce", "comment": "Malware payload", "value": "66f7accdd84a68b64cb151ce0c7e446b72a600e4904ee4e8134eed54b9e54287", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980498, "uuid": "8e0e260f-9fee-434c-8828-613e9abae7bf", "comment": "Malware payload", "value": "101be3664c97d8819bfe55123794dff2a34a2491", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980498, "uuid": "3f46b4a9-167e-4b47-a7a6-9f1e4e065940", "comment": "Malware payload", "value": "1a2eeecd5034b1c2ea26a44b1ba786ba5a2b2eadce2ea76f89457fd85ad71084a25609969c2ef1068258ff6edaf64829", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980498, "uuid": "4e3fe356-a22c-4054-83ba-27bb9ca9456e", "value": "T1A02296764B960972C31249F860BE6A0359BD5A0647C959E3CFE01C0EBCA43E72D32AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980498, "uuid": "93d820bc-b05d-4d33-8e42-97ff4e45be4a", "value": "a1abab4459c07e768c7c2de6cb1dfdea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980498, "uuid": "33ba827e-d0f7-4546-9dc2-52c54d64a936", "value": "192:2DMzeAvxnWWI+1H53yoncQWHDy+qfaSdRwzYKoJr:2DMzMHAHXuyDiSdGcRJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687980498, "uuid": "00708a13-5e69-4289-9d9e-ae13e882a6bd", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687980498, "uuid": "0040696a-f00e-4d1e-906d-12b732270e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980498, "uuid": "8069295d-3dd8-4168-b57b-eb7450966fc4", "value": "SecuriteInfo.com.Win32.InjectorX-gen.27288.2581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf57dbf-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687935663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935663, "uuid": "509b9b1e-a01e-42d6-bb1c-7b5b9696c35e", "comment": "Malware payload (Mirai)", "value": "e486c6995536a4c8fc06ada7a9b4e03b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935663, "uuid": "614dc97e-d1f0-44b6-b342-bdee1e758e13", "comment": "Malware payload (Mirai)", "value": "68bca0e3c10c0ca9e820a34b7b51ad7613355e52b9603d426fbc7980645be730", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935663, "uuid": "61df9fb7-47ef-4962-b333-211df0cf11b4", "comment": "Malware payload (Mirai)", "value": "26a7678cd1d6c2e664b571cea734f78e3195fb95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935663, "uuid": "f5816182-b1e5-41f7-b4b4-455f91b0b3fe", "comment": "Malware payload (Mirai)", "value": "97060b4f6d6983d8bc0fae54e049e25a5b094be6f293f873f792f4238bad288f5992a21ee889c96b02f91f6e5a94023f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935663, "uuid": "72e8e41a-41d8-472e-8d3b-19a24d1c840b", "value": "T1A903D785B9869A07CAD4537BFA0E42DD3B2573C8F2CE3313DE162F51368A92B0D6B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935663, "uuid": "a87cc80d-0928-40d3-9c85-10a573ad4b82", "value": "768:R8cgPbzj5HoD2ogElo5fEFn8fuP5KZ7mrLIZUI:Gcg8oDfnfuxy76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935663, "uuid": "c8813dbc-5726-4c37-ae56-2fe4354a50a2", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935663, "uuid": "7711584b-07f9-4a1d-b194-38d5c0edb688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935663, "uuid": "dd92938c-4b01-4dc1-ae0c-e149588e89fa", "value": "e486c6995536a4c8fc06ada7a9b4e03b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b1661a-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687933260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933260, "uuid": "c8d0fd65-7f78-40f7-8c29-a27b4ceeb0c7", "comment": "Malware payload", "value": "9511afafa38f0f048ad19da45f4d5980", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933260, "uuid": "c9b500c3-fa6f-4c9d-97f5-cb8608ba620b", "comment": "Malware payload", "value": "690ac7cfa35e4844a894925dc2089ef4e688e8c4466ffbca3e84e2cc43899b2e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933260, "uuid": "0c6cd6e7-9d31-4c6c-8bfc-d4e403077ddc", "comment": "Malware payload", "value": "6f67fa1fc62254e6063ca6d6ab9ca6ea51fc275f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933260, "uuid": "4fd0acb6-64a0-4137-b957-fd7069ff5b72", "comment": "Malware payload", "value": "accc61154cee7e29db73f3fe9e476e09a6acefeda50bd28bc9af79b8c62b50921f9e7ef8efe838254381f818cbc96883", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933260, "uuid": "04614d7e-d07b-42df-bbfa-c88dfbc59c1b", "value": "T1C6B64A7BB2A4C129D15DE23AD4AB9F40993374B61B36D1EB529013A60E26DC0DE3F770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933260, "uuid": "32071f6b-5f88-460a-b397-f41bc22a468e", "value": "49152:xVfI6+5cm5QQHJhTVcpMVX/CZlq57SKfNfREGjtlkUSoV+9J8Ho1EIqERLIHQepE:I5c0x7I+933Ho1Et/+zxtcs820", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933260, "uuid": "a6d4bd4b-94c5-45e4-a693-18dee84aef3a", "value": 10447872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933260, "uuid": "4ad31d1b-a819-4b4e-9309-818c5f9c2176", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933260, "uuid": "77482a95-14f6-4958-bd9a-847c5b99e513", "value": "Archivo-PDF.704654.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dde02d-15c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687964325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964325, "uuid": "0096a00f-21ba-424f-8f88-53266a8e6489", "comment": "Malware payload (AgentTesla)", "value": "b69a55065be2b86cfa50db0195fad1e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964325, "uuid": "e1cae23e-3be8-4eff-9c78-cfb0ab9c2e2a", "comment": "Malware payload (AgentTesla)", "value": "6ac53fdae8e1f8f64b9bdc321f0690935f29e26605451b268119cda2a41b6bda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964325, "uuid": "ecc769fb-0dcd-4ff1-bc12-e967ae58ab35", "comment": "Malware payload (AgentTesla)", "value": "f424173321f42dcc8c2afc774d3552286c372d2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964325, "uuid": "e86447d6-eef6-4350-88d5-c1bda75777b2", "comment": "Malware payload (AgentTesla)", "value": "e2cd727fc61d00f60a77d67cd052adeca9cf12128c23e724b57d1938ae0d1feb4767c9b741c08d4b8779f1d5c1545098", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964325, "uuid": "33c79268-0e74-4037-accf-bf4d9d517704", "value": "T1D4E4383C18BD2B27C075D7A98FD48023F664943B3922EA265DC297D54756F922AC323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964325, "uuid": "bb7c61c8-a09d-44b8-89da-ae9f73e9beb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964325, "uuid": "ca9d3cc2-1312-4eb8-a811-a53ded658209", "value": "12288:3mRE4UjrSOLa8O/fmE0lBEyO7jDcbzOXV23y/I8PiiAyRKkAmQKCdtPam:b4UHSga8OwlWyPeEC/I8dRX4dtPam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687964325, "uuid": "ca520962-0789-417c-9e66-abaeaa3ea0ce", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687964325, "uuid": "331e01c5-3350-48e1-83dd-77f5fffa8221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964325, "uuid": "2db4219b-1290-4c2a-8953-51dced669983", "value": "8200016543290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e5c001-15d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687973481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973481, "uuid": "019cae89-1fa9-4ecb-88b6-c2a22965fdb8", "comment": "Malware payload", "value": "5d9fdc86efeec905da856bd1a1152eb7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973481, "uuid": "f0f5afcb-cb85-4fc0-bcef-b3857e69d7f4", "comment": "Malware payload", "value": "6b79f3db022f6ddb398674353f289d421c488327c15e78c914840fd1227bdb78", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973481, "uuid": "60a810ef-7dbc-429f-a516-cfee6eee2c26", "comment": "Malware payload", "value": "b979495f5a9fa8a61bbe60203475d8c6d0aa381f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973481, "uuid": "08a98880-59a8-4779-a544-b75792c7a169", "comment": "Malware payload", "value": "a359f86518a0d65ea1b20f66c760c6d1e5a9f95fe30cfe2e1d402f6a21be2ee0e1a7d9fb62713b199ac459159251a8b8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973481, "uuid": "8a54cbf9-6645-4e80-9384-f965c737834b", "value": "T1E746F123BFDBC42DD96B687391C3A562642A41A8AD4BD47F12D01985CA30C4B17D3FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973481, "uuid": "df1e1ad1-f0a4-4541-b446-52b586a01164", "value": "98304:nPyQE/sI2aMZv09QeBARNzmZ03cPopjRLus9wx92zMD7GR:P+/s5aMZovivzzMPWjxfWx92zAKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687973481, "uuid": "956f29d9-d10e-4e91-b40a-24f9bd298e81", "value": 5735464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687973481, "uuid": "c233ab46-6478-409c-9bde-6d0d368e5ace", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973481, "uuid": "4b689fef-56df-47ec-bd99-e434c99e1dce", "value": "6b79f3db022f6ddb398674353f289d421c488327c15e78c914840fd1227bdb78.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def98b66-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1687962002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962002, "uuid": "4c3b9884-27ab-4b98-8ae1-01214efeb206", "comment": "Malware payload (NetSupport)", "value": "485ee258552223a0d1e939d4b95b20f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962002, "uuid": "a1c494bd-0424-45ad-bc39-84888324e739", "comment": "Malware payload (NetSupport)", "value": "6b9796476ea4bfde956b54ec34cc751539312ee9b721f25d293c38ee7f794cc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962002, "uuid": "1970b3b5-1320-43a7-ab54-37b705fec99a", "comment": "Malware payload (NetSupport)", "value": "3f7bd2113ce283d916a4a5da3eff420e640edc0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962002, "uuid": "498eb030-5f4c-4657-b5e8-4c8476043738", "comment": "Malware payload (NetSupport)", "value": "8ef048594572564b0b9b58254cb6ccc2906c80659c158ab99d5799f300d66d63cc40498d1784e0ef9ce28e5e445247c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962002, "uuid": "b5b8c4c8-4457-4076-8bb0-de122c4a5f8f", "value": "T139F4AF36AFD18C37D163153D9C5F9F549B2A7F823B2469462BE81C480E39349F82B297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962002, "uuid": "c29e9c4e-e8c4-444e-8cca-55806e444500", "value": "17365fb09cee750a288cd9548c0c135c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962002, "uuid": "71301add-77e4-4043-9e89-b46d19784bd8", "value": "12288:OuLhOCgdyL20jgjcw/JrosV8mNh0T4OazdiSAIehvsigxq1le4H4gwGwr6kUj1IB:VFONyL20jIcwTu2WFasHhpgAz/4ckUZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962002, "uuid": "f8697af8-1bf3-4d12-87ea-88797c38bf78", "value": 730272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962002, "uuid": "b635a9e9-2783-4d72-a55e-ee54b18adcdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962002, "uuid": "070ec2f0-6c31-4dd7-a596-e39354f8ac7d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff592e9-157e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687934543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934543, "uuid": "b963324a-4dce-43e7-abf8-4d6e5f9b1fc9", "comment": "Malware payload (RedLineStealer)", "value": "3d1d713916277876d2c623f003bc9b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934543, "uuid": "4bcda82a-c43d-474b-9843-cddfe19ba6f1", "comment": "Malware payload (RedLineStealer)", "value": "6bef0e06e4c55a6db9e294929072ef81718e57f86baa23bac45f2d5ae5d8a39a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934543, "uuid": "df16a503-8afc-4f73-a6cd-9ca0ebbdafc5", "comment": "Malware payload (RedLineStealer)", "value": "564a1c304584f1d2afde36c5d7968da217c97592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934543, "uuid": "5f1a1c31-88c4-4fe3-b038-75a4a8155360", "comment": "Malware payload (RedLineStealer)", "value": "b9c322d95ddf494bfeb3333159e420a4449a0e8e5bef068f41d6a33f512634691edb979425ff7ce88a24520e79db38f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934543, "uuid": "94128258-c539-4145-9531-ddd77c06138b", "value": "T1CAB4E11175D2C473D533113709A8DBB95A7EF8304E659AEF67E40F7F8F60280C622A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934543, "uuid": "75412f4d-cba1-401f-b8e0-bbb4b09e76b3", "value": "33c13c7e2740049764c0170b710e37bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934543, "uuid": "93209896-e284-4ab5-a889-d185a6a42fad", "value": "12288:qTiZU0RzDnLvrRfRnI13mAB33Rx3w0E/a4fU:MiZHzNmRLBnRpw0Y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934543, "uuid": "23403426-13ec-4cd0-bd82-888ff0414e24", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934543, "uuid": "8c6562e8-2d86-4455-905c-df4a446f59f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934543, "uuid": "42c63c8e-7f3c-4505-a29a-cd260cf849f8", "value": "f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b5347b-1573-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687929665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687929665, "uuid": "67b3e800-9d96-446f-b4e6-00cb773ebe48", "comment": "Malware payload (AgentTesla)", "value": "f2707d788cc86c8707eee04679ddf651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687929665, "uuid": "193c5a98-0873-4464-9d0d-454fc2f654e0", "comment": "Malware payload (AgentTesla)", "value": "6e4b2204ab34ef1534d3c80e379e200f37a05e04ed2856d2df2f5983e9351ce6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687929665, "uuid": "b2183871-9e11-42dd-899a-855e4230e8e6", "comment": "Malware payload (AgentTesla)", "value": "41fa43a8d787ac9308c59c308d0ca926afe5511b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687929665, "uuid": "fc1c8ee3-1c94-4482-8c9b-0d9831f362cd", "comment": "Malware payload (AgentTesla)", "value": "bd94539c2621830948e9d99453c4ea07cf07bb77ed69075e3c95179fd8ba52adc521923a1e913a1bae359f7b94b73b89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687929665, "uuid": "6eb9a47a-2bd3-4560-b050-0dc8a125fee3", "value": "T1DEE47A3C28BD2A37C174D6A98FE1C463F154C43B3D21AA3268D797A54746EA325C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687929665, "uuid": "3efdb1b5-46ab-444a-8403-3f1bf8f56640", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687929665, "uuid": "0121c0ed-e789-46c3-81aa-3f2b7377b205", "value": "12288:94d+Nmew4kVh1guW9naLiEktz6TTA7dFvXg2DU+2b0:9nwVquWFaLiRB6Tcj1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687929665, "uuid": "8199d992-37ed-4dc5-8eba-2c87f9f6d64a", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687929665, "uuid": "fad93c43-675f-412c-ae79-e09f04a81530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687929665, "uuid": "6d080e00-53a2-40c7-8dcf-072f0f803b84", "value": "f2707d788cc86c8707eee04679ddf651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a025e616-15d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687970916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970916, "uuid": "f25e2a56-5689-42aa-9023-cd41f225bb50", "comment": "Malware payload (Formbook)", "value": "5efa5a8dc95bb53a69c1e2124966eb68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970916, "uuid": "ad164db0-591c-43d2-84e9-3e18be1205c5", "comment": "Malware payload (Formbook)", "value": "6e4fa72cffa8c6cbfac487753758461e7c066e4390954ec1bd4fd26223111fdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970916, "uuid": "907ea3ef-76c2-4cb0-8f6b-72949b962078", "comment": "Malware payload (Formbook)", "value": "269565a62437e09263ed633ac2a11fddd37d8868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970916, "uuid": "6f825059-7ac5-4de5-9e91-d1f5f7384ce8", "comment": "Malware payload (Formbook)", "value": "007dcd0bf865b230366df6f86faa663f6a76bd24ac751fab85789172843e90f7b36bdca01c46a4a6191fa8336152ddbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970916, "uuid": "d13dd9ec-f945-4831-9c47-d4669ba71e73", "value": "T1BEE4393C19BD2B27D035D7A98FD48063F2A4943B3921EA2659C397D50756F922AC323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970916, "uuid": "39358ea2-8fca-4e3e-9672-af4492825d75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970916, "uuid": "5dec9fd1-bf2c-41e3-91b9-b42231779642", "value": "12288:lmRMesDfGR0XkRDAxuYUd5sGdiY7mNwr03BV2fr7Ff9rM:Nes7XkRD4uld5stGr030B9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687970916, "uuid": "9116dc5f-7374-413f-8df2-f0080c6d8e40", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687970916, "uuid": "055a587f-1d03-4848-8316-b0a09b200ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970916, "uuid": "86dab487-7a23-42b0-9f7d-0087d2a6d805", "value": "z1CurriculumVitaeIsabelGonzalez.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e409e91-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687962699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962699, "uuid": "b8f51ed2-7db1-4a38-9ae0-80651116a756", "comment": "Malware payload (SnakeKeylogger)", "value": "10eebd89f4d1542bd26b4afb03b69816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962699, "uuid": "678b5ad0-d439-4dbd-9cc9-052fd26a089d", "comment": "Malware payload (SnakeKeylogger)", "value": "6e87676e72b88f603f2d0668067b51e76e7ae433d52845d76d5d5280d2be4e8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962699, "uuid": "925aa987-923b-4e59-8c4b-57ea30aae342", "comment": "Malware payload (SnakeKeylogger)", "value": "37ae9dbbfa2b5eaa8a24be805b98fef4bd620cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962699, "uuid": "ee766398-71ac-4de1-8b18-6f51f70ecad9", "comment": "Malware payload (SnakeKeylogger)", "value": "a3b668efc14b519d364d6c625a9277719ce6708bfeae11665fb7333908edc463652549175ba3491456465ef8e2a6ca74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962699, "uuid": "0f2c7eb0-e5c4-4dd2-8a5f-59b61cbb7ed0", "value": "T1E9E4073C6B7D9A22C034D6B8CED584B3F2558F3AB411D522588A7BB52772B521DC332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962699, "uuid": "0cd951ac-982f-4069-928c-2fc047079824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962699, "uuid": "20370803-6db8-4aa2-980b-3060e6f53c4d", "value": "12288:kcj6OCWEjJHpjyFEX1M/ngT4ARjbyGjaw38NC2keP:hlvY5BSeZybwMNCReP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962699, "uuid": "95bb76f1-3148-4f4b-8e00-ffd9a023cddb", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962699, "uuid": "9b954e7e-b725-41f2-99e5-78cf2844f986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962699, "uuid": "2bae07f0-511e-4a00-82b7-4525c54944a0", "value": "23-010-04354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447b9fdf-1585-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687937261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937261, "uuid": "8891022f-69f4-434e-a9e5-1deba161dd3f", "comment": "Malware payload", "value": "19394ddb01e391b26fbf87eb8e2c3e83", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937261, "uuid": "68517e69-bf4a-44a9-93b2-679aeb07dbec", "comment": "Malware payload", "value": "70bce7e06ec327ad1d84b8a1f0a486004e5be981cda1c011c67fe69994a4500e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937261, "uuid": "1130984f-d2d3-418d-8c22-db83980f4747", "comment": "Malware payload", "value": "6880a869f17bd9d8d7569d4443a590870fcce505", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937261, "uuid": "e6b3a3b5-edba-4194-b0be-d053c97b37a6", "comment": "Malware payload", "value": "b726d8f51389069b1e72ac2e2c0c379b422d77e4b20dfcbf9a6fb50c87eff128940320cbd53b5616df0a0477c0d0be3b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937261, "uuid": "b4ccdd71-8b99-4710-a13e-176c0d940cd0", "value": "T1E972AE36D30DF815D8229479940A41F5E3B48497B5A2FA2E3AC0FEEEC6217631B1B59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937261, "uuid": "49cba0d9-4fc3-40ce-ade1-72e6189018fb", "value": "192:CtmBiUjW9nxufp7JiaCCNxtpgoZ22NN/T0K5mG680Bmew+Wfm0FfkvGUj6p9H1+w:a+P69O/iadNxt/ZtNNIzHw+30OqGis0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687937261, "uuid": "af42bedf-5065-4bb4-9cf7-53e7b25fb6aa", "value": 16049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687937261, "uuid": "65e33a18-86c9-47b2-a0b9-024bdade3c41", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937261, "uuid": "038ce512-ab4f-4b00-b741-76430abb4311", "value": "Boot Camp tentative schedule 2023 (1).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9d8d07-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962612, "uuid": "26034240-3b74-43d7-ae00-e94b78e1d378", "comment": "Malware payload", "value": "17967a06f7e80a94789e43029e0c1805", "object_relation": "md5", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962612, "uuid": "9d9a359d-68cd-4c55-abbb-58162c7facbd", "comment": "Malware payload", "value": "71d92e20cdf124a08a5a7ac3f47d067322b6fc8bfe11d49f1f987fb23e628dd3", "object_relation": "sha256", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962612, "uuid": "8b41b8d5-da9e-4770-b8ec-2a722bf04a47", "comment": "Malware payload", "value": "bbac693c35ef4924885ab253781a02ca2c57e09a", "object_relation": "sha1", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962612, "uuid": "e6290462-72e5-4742-a013-c9eac961ad80", "comment": "Malware payload", "value": "3c8b293acd11e5f340deb49ef1375f65b9b312d1c6368ac7560eccc9cfc19299cab625ce076abca059fe01b506019e93", "object_relation": "sha3-384", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962612, "uuid": "ea2ce4e7-77ee-4f90-960d-531160280e8b", "value": "T1DE85D042E3CD8391CA325233F976AE256E7B3D3949B0F15F1F88353DAA72262411E563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962612, "uuid": "58f0c9f5-1fe6-45ac-b9af-7d940a8f8d80", "value": "fc35a0089284ff9c7c45866438ea8a25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962612, "uuid": "e819736f-573b-439b-9924-61fafba3bd51", "value": "24576:G4lavt0LkLL9IMixoEiUdtRsu9lb0DX0DkOou268noAgCl3KF4LnPoY:Rkwkn9IM1UdtRl0DX0DkOjz8o1ww4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962612, "uuid": "6fa31ab8-a2b6-4d49-9264-2f3f8e10660b", "value": 1814016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962612, "uuid": "a5d5aff9-0cef-46f1-b492-d706c6745d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962612, "uuid": "1916f0f3-c002-4145-bf86-a0218b0cdad2", "value": "Acrobat.Pro.2023.x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8ceba1-1556-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687917035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917035, "uuid": "2f19cd0c-1692-44ae-be32-4c6cf11ecea4", "comment": "Malware payload", "value": "4ee264403dfdb6819b2a5fbce554f3ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917035, "uuid": "1ecdc256-612a-4985-9796-2d147cc7a4c8", "comment": "Malware payload", "value": "71f444cfde53289c8819334aecde5e7f3c52d0d094e07443af7eb47edc5f0b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917035, "uuid": "1d59bd5e-3cbc-4a66-92f6-7cd86e60c022", "comment": "Malware payload", "value": "b351c059d8dfbe69ac1b1d0100e49425dcecf5ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917035, "uuid": "3c0108ad-ffd6-4cb3-9089-9108f5b6b798", "comment": "Malware payload", "value": "6485d08e8d9ec9410d409de574f93aa3db4bf965583122e648bdd1e8c9878678d8eace53fd192d53df6161754db5924e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917035, "uuid": "a20a55c5-e239-49b2-9a7d-8300ad9a9c19", "value": "T11422500275B298B2D577CAB844F58A81A62B757BABF190050D7C429DEFA33D04F37362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917035, "uuid": "366dce0c-fd28-47bd-b855-2fa414266cb2", "value": "192:KSLZ6nPp/KVfnnnnnnnnnnLuoPunOafrMdQ35+:K2ZEdSDuZnOoMwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687917035, "uuid": "f80fa3c3-fe18-484d-a474-745bd443fdb5", "value": 10743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687917035, "uuid": "3ee20dd2-9473-4d23-8d9f-c6ec1003528a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917035, "uuid": "71823e3e-7beb-49ff-9905-af0648f73f5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026d2b25-15c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687963350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963350, "uuid": "a2581f6d-7497-49dd-b94c-d0ef494dee0f", "comment": "Malware payload (AsyncRAT)", "value": "e23d0a4651d9313e5b46ef7a14aad2ef", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963350, "uuid": "928829ac-1998-40fb-8941-518d6811b347", "comment": "Malware payload (AsyncRAT)", "value": "72b60597a7e9fed89d9b5383f6b4bc331fb0416795f17cddc1a3c32e15d50691", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963350, "uuid": "26a510da-4b6b-416d-84d7-a04a289834e6", "comment": "Malware payload (AsyncRAT)", "value": "4fdddd186d06c6c79a1f50409dc1aed3fa0f13d1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963350, "uuid": "01445757-9ade-4d86-bbf2-05db4abdf90d", "comment": "Malware payload (AsyncRAT)", "value": "9306ad6c4e6342c73ffe1c78ba31ebe568d829c6f71b3bcbf77c183a860185ae132c284fe3f6d5ca792bac1d15a4ab1b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963350, "uuid": "dcd2334b-ac71-4942-9d15-54ad744903e7", "value": "T18E04492437E81919E3FFCBB8F4B001259B72B8236913E76F28A459ED1D62345E550BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963350, "uuid": "7fc2a95d-f96b-4ed7-9bec-3f62ba37bcf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963350, "uuid": "04c463b9-74e1-4187-ba7c-439ef7eb00b8", "value": "3072:G+STW8djpN6izj8mZw+GSv5hqIPu/i9bcJ2cwp6+WpD:b8XN6W8mm+vvnXPSi9b4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963350, "uuid": "d3475cb5-d4c8-4cbc-933f-da396b202c38", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963350, "uuid": "eeedbe48-eeda-45e8-82a8-061ee4065dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963350, "uuid": "09f4edc5-052d-4333-a87c-45ec0d374699", "value": "e23d0a4651d9313e5b46ef7a14aad2ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dc474b-159a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687946411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946411, "uuid": "949368eb-b477-49fa-b661-3f37ea43e925", "comment": "Malware payload (Loki)", "value": "f1d04cf9d4714140d08ec9ea4861ff67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946411, "uuid": "18a255e3-790a-4e3c-8ba3-7d133049e014", "comment": "Malware payload (Loki)", "value": "74f8d1759f417fb26728dfcd2b5860b7d6027c5546a6b5c237b82e11f909d855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946411, "uuid": "afa0cfda-769f-4bee-accc-050d2fc67bdb", "comment": "Malware payload (Loki)", "value": "c25147768e29fc15fed6b68e5f1ef3ecf13cba52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946411, "uuid": "5daf71ff-bc52-4bbe-89d1-9bcfb692d705", "comment": "Malware payload (Loki)", "value": "43583bc9987e6f2a533d23b6a7ae329aa11dd71749748406c662a2984c7b7eaca38a800f2ee239725f992b6dc38b507c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946411, "uuid": "cd815c97-4bba-40fc-87ca-3b7208387100", "value": "T115B41240A3D22196CC9548B619AB117A1DC5AC1388C45F83C78D73297AB3D4AFD9FAFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946411, "uuid": "11bb30ed-c854-4e3d-b1b7-1db2348b10a1", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946411, "uuid": "49386b9e-a3be-4c34-830e-ad90113271a4", "value": "6144:IpkXGh2JKBG73lIVXctG1vEHctaafmMxPEoQ42G70DQCoJA9XtInl1akeqEp6L:9FKBG73lOUG2H7zS8zjDQCoJOIn/a7XK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687946411, "uuid": "d23b9369-bb6d-49db-a444-1e813cf718bc", "value": 515013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687946411, "uuid": "dedc1678-31ae-4807-84a1-81f3448b0a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946411, "uuid": "4d35a1ad-82e5-4f47-a134-c87a66343132", "value": "rBLDraftcopyShippingDocument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30d7c6b-1580-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687935353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935353, "uuid": "c5dbc621-9958-465f-926e-c24fff3d4346", "comment": "Malware payload (Mirai)", "value": "e2d6f8bcf2e57d150cba737198cc8dea", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935353, "uuid": "e5bc5ec2-a83f-4953-b16f-6a96ca63c483", "comment": "Malware payload (Mirai)", "value": "76ba2fcd2ee2f42d6cd64e67c39d99fcfbf76d514ca0566a9af73c1d6ebfed5f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935353, "uuid": "17d491ff-ef17-483f-b1d4-183a660aaaf0", "comment": "Malware payload (Mirai)", "value": "e601c72324e6d27c962301fb1d46cade85872562", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935353, "uuid": "3b678fd7-7019-4877-a920-9ef9d83c1818", "comment": "Malware payload (Mirai)", "value": "d014061af5434fd2a57c028a1fefa338141a6e428bef56021c37bcac0ee7bab8fa7cc37b56295f7a4e29f08476e3344c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935353, "uuid": "18d3de8e-2e95-4496-9a09-f5c237008460", "value": "T14A0307532450D1FCD589C5705BBFA22BCA33F03D5235FA9A73A47E2A6D0BE311E1A849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935353, "uuid": "1f3c9f46-6629-4ed1-9cc5-f141664dd709", "value": "768:gl18lk3Xvf+xL2JRmmc17Clb6jrojNC5I:olHnxTmr7CF6fB5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935353, "uuid": "c3b8ec6c-837e-4639-b4cd-6b4b9ce68c29", "value": 38144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935353, "uuid": "41d8313d-85af-4670-9e23-dde44ffe257e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935353, "uuid": "2115c12f-564e-4bce-b31d-158838954adc", "value": "e2d6f8bcf2e57d150cba737198cc8dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7745ca4-15c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ShortLoader)", "timestamp": 1687963761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963761, "uuid": "5aacb846-f74e-4ab0-8b61-8489d4cdaf61", "comment": "Malware payload (ShortLoader)", "value": "6c805a6db0954cedf39a5637ffa48fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShortLoader", "colour": "#505EF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963761, "uuid": "c93d31be-759c-4106-bbff-f47eb146d0d1", "comment": "Malware payload (ShortLoader)", "value": "76d30586c345897b9722866c7f2f5f98f55a98228a1ec16bc020ee9ad03ba42e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShortLoader", "colour": "#505EF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963761, "uuid": "513671e3-57fe-4745-9d22-3578e40333b7", "comment": "Malware payload (ShortLoader)", "value": "108b3d9170da35a39ebccb3f51213d50a9c52db7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShortLoader", "colour": "#505EF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963761, "uuid": "937d953d-bcba-471c-a249-b1faff1e5112", "comment": "Malware payload (ShortLoader)", "value": "1b9bc6cd33c63c183970f4d4326d9d53860de0182c22f4e86cf0090711aca79e6ea2ded3ace92e78588aada10f0a9c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShortLoader", "colour": "#505EF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963761, "uuid": "eeab6752-266d-4263-9704-1e9c314ee5ff", "value": "T1D6F1D806E7E54337EDAE0B7EA8B3436043B6E7214C13DB1E58C9825E5D537080AA2BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963761, "uuid": "0fc51bc6-d225-4aa0-ab1c-fa83fe1a42dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963761, "uuid": "b80cd621-31d9-4cec-88c7-2d6461da6e9b", "value": "96:hJOuj5RHyNKEfTa4szRkd6Kozt1LUf+tT/zNt:viFmPdG63oMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963761, "uuid": "1d44bc7e-b95a-4ceb-826e-6976fe9f6666", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963761, "uuid": "ad09924f-6cde-48ce-bf58-15f714510cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963761, "uuid": "f884a2bd-2dd1-4dd6-867e-5df1a833e14b", "value": "6c805a6db0954cedf39a5637ffa48fd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b897c33-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962614, "uuid": "224d6017-b8d2-4373-b22b-16fba34ac98e", "comment": "Malware payload", "value": "6312cd3ef1fa4c67a95db166a7a7d57e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962614, "uuid": "fc15b657-4dab-4be8-8b00-b2b8d4d94dfd", "comment": "Malware payload", "value": "76e168de7dbe753c4fe2cf48f1999ebe059af148eab703a1d8b0b0c47d32b201", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962614, "uuid": "56babd6c-1759-45a4-98ff-4975d422e992", "comment": "Malware payload", "value": "fbb3e396a4c9378e60f1c6769827eb8ed7176e95", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962614, "uuid": "2ba838cd-bc15-4f6e-8b0d-d64cdfcd8cdf", "comment": "Malware payload", "value": "c4b6d9b7eabec5c19b7deb4937d1e02aaf707c5878b1406976b9de6f1ce890e3a3d57e907d44d1e3466a3a500cd0ae26", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962614, "uuid": "ad466a62-88eb-4481-9e42-7a6ba9fbd530", "value": "T1E0F0DC3CCB68F3D0601FB084491C2C0722D04B73EBF65E05E9210833082835EDF1104E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962614, "uuid": "e2688356-e70b-408a-9a75-58eb8d2ee4d5", "value": "12:M/+f/uspkiHkNsaNiLTlLHPLnggjSr8Iqcxv2zqXBPY:S+riZNGTlLHPcgjSr8IqoNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962614, "uuid": "ce4b63ba-fa9a-4f91-99a9-30a8474bf04c", "value": 445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962614, "uuid": "439beff6-bc6f-4947-8f69-7a7fbb2389ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962614, "uuid": "d1b2a841-7b80-450d-9d5d-858a64086647", "value": "Activation.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcfa761-1559-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918275, "uuid": "a450656c-3831-4ab0-b04c-65e2f3d53b4d", "comment": "Malware payload (Mirai)", "value": "6c62a415c03048fb3b2b9862b5318514", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918275, "uuid": "ef886220-6c0b-4d6c-8846-9c1b093655b6", "comment": "Malware payload (Mirai)", "value": "7963d88a675d484d7c0ea002513a132ea6aa91c0a126097871ffe8b2cd8d16fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918275, "uuid": "011cdead-4b4d-49fc-8632-93f9cf319f9f", "comment": "Malware payload (Mirai)", "value": "eb414fa55f986f7e2ad948da29e5273e008e3453", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918275, "uuid": "a3de3492-cced-4b06-b28c-1ba3b24e4299", "comment": "Malware payload (Mirai)", "value": "8a1b89e5106cddc89f80e7e4e0fe7b24391813f0cadf77d25ad7bcc3ea23f0dd8c3e5a89a9f5857ffbff73df955f50aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918275, "uuid": "f72002ee-4415-4d75-a804-b12210f2734b", "value": "T1F5A2E01572A32E66F3ED1C3DC96A8357B9A71BFC80F633756D406520C94D20A3E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918275, "uuid": "0a192e90-0c02-4ee1-a180-e56874e3128f", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjMwhymdGUop5hQ:TvQn4j+ZO5fKAlxows3Uozy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918275, "uuid": "6474bdae-d31e-4db9-900f-12b2d150d3d7", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918275, "uuid": "b0d90413-e661-40f6-bb71-fa63b0d25113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918275, "uuid": "c27cac46-da46-4506-8dfd-69fce3c1ee60", "value": "6c62a415c03048fb3b2b9862b5318514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feaa41aa-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687963344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963344, "uuid": "d3be36f5-2519-4bc2-9dbf-f9c201cb8562", "comment": "Malware payload (AsyncRAT)", "value": "ecbd37c3d75e81c121cd89bff24dcfc4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963344, "uuid": "220f604f-e632-41a5-8d65-d22db8a9b04d", "comment": "Malware payload (AsyncRAT)", "value": "7afcf780cb130e2d294e7eca704cb2914d50c738748da431ee275dacc3e5344e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963344, "uuid": "3a335e33-5ac5-44a2-852b-2e2e804b4955", "comment": "Malware payload (AsyncRAT)", "value": "93091c7c56c6c183dd5936085e1b7b57fad5224e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963344, "uuid": "34008eb4-5a12-475a-aa5b-a2a8d9388cf3", "comment": "Malware payload (AsyncRAT)", "value": "3ad576664fde05f71046ddb00d9c4e32ada8ea87e2262031dbdb37cbc610c8fbbdf085b2b2b81df32f9b54289449829f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963344, "uuid": "744a76e2-66aa-4c45-aa2d-0ed8e24b94d0", "value": "T10F044A1437E85919E3FF9FB8F4B002258BB2F823A517D76F199458EE2D62344D910BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963344, "uuid": "2d3a04a8-2600-4afd-b50c-75c48fe45c0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963344, "uuid": "21a83f8a-1cb7-4327-b802-fff1515c5e99", "value": "3072:S+STW8djpN6izj8mZwP900qo2HD9avlCIPu/i9bSJ2crcgR6+WpP:P8XN6W8mmP9kHDYd/PSi9b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963344, "uuid": "8cb4327b-d8eb-4e01-a13c-10623fafe476", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963344, "uuid": "85068b1f-79bb-4882-8391-95424564a1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963344, "uuid": "25d46fb2-62a7-4d9f-9f8c-2628581289e6", "value": "ecbd37c3d75e81c121cd89bff24dcfc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75918266-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687935626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935626, "uuid": "c8e76e7f-8b76-416c-a812-af7e71c13a87", "comment": "Malware payload (Mirai)", "value": "9b99f826780f65c9b86f5e80a8d628d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935626, "uuid": "7e688ecf-d595-48e0-a6b9-f59c37c727c9", "comment": "Malware payload (Mirai)", "value": "7ba34950b08db772df47dfe369b19155ad3ede44f58ca29826d6175c0555be05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935626, "uuid": "985dd25e-7a2d-45ed-9b8c-8885038e6b80", "comment": "Malware payload (Mirai)", "value": "5bff49b7beab47dfe51e67d50446471fde6939e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935626, "uuid": "e5dda531-35a8-46b7-ac37-16485e15c910", "comment": "Malware payload (Mirai)", "value": "462d2c9113f7929ee71481cd47c04507dfacef487e8bb7f38b57ab6042856b61553fdad71e29282a349c7246bc7dd9c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935626, "uuid": "5e203647-c039-48d2-8e7c-9f3faf270468", "value": "T1A0F228E2B802ED3CFC5FF77E80060A09F831725959821A7663A3FC675D3619C5E66E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935626, "uuid": "cebd2539-0083-47df-93ad-d7e8251af7a1", "value": "384:dC3KQQRQ+A+A+kMph7eGoWjGv1kH6SN2T+rHCbFWk8jOAoNiTCCXZvhTpPN6aXKf:ed3M3Qv1kHBHrcFWk8jINiTnhTNNRXKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935626, "uuid": "903017bf-a4c0-47bb-9b3e-bffee5dd37ea", "value": 35576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935626, "uuid": "4d5636d6-799a-4417-91a2-5cd52b746ab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935626, "uuid": "a11bd623-3432-4cdf-a5e9-d5abfee095f2", "value": "9b99f826780f65c9b86f5e80a8d628d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7e4acf-157d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687934054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934054, "uuid": "05d29f62-0cf0-49d7-8a93-784111ff7621", "comment": "Malware payload", "value": "e6f39d13ff22ace7a957a647cfee2b7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934054, "uuid": "16862dd7-b566-46bf-86f4-7631b9b82cbf", "comment": "Malware payload", "value": "7cb1cce5dc6c041af95951f20a11ee68fa6b657701c41972bcfca6e03f0ec9e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934054, "uuid": "7efb8b8a-2c16-4cfb-89b8-fb904d104b84", "comment": "Malware payload", "value": "c7cceb564927e8a3e9a8f119ab02e548878dc5d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934054, "uuid": "e3a6b818-0837-431f-95ea-39bc2a620e86", "comment": "Malware payload", "value": "3cd0392791edc468838c5f4032717aa92eacfb7ae2404ce74379de57b04ad3a5240337536051feb39669dea24fdfca9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934054, "uuid": "4d8d1a50-31ba-43a8-97a7-0d448cf18e2d", "value": "T12E049F35C5430C6FF4A7CA7160B607F89864AC54CB8480EB67EC68EFD4695C6EA32D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934054, "uuid": "17534257-87ef-4781-ac0c-ad5502842507", "value": "9a55ed559c19ff5b7d0ca29dc019c656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934054, "uuid": "fc800d89-b906-4a85-b548-7aaa713bf4c0", "value": "768:9yJ5GoqB2ZyueYnM3S9wK5NSbIB4Sa6Eko2MCXWyDhzjtRpvlQV:9RCUJkxP8ZSa6THmqhzjtHuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934054, "uuid": "ee2b88a1-ec28-42fc-b65f-0db31e832dda", "value": 180312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934054, "uuid": "e4e95949-6cbf-44f0-b848-4f7a704d2297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934054, "uuid": "efc859f1-dcf6-407b-b07b-d193176bbd42", "value": "e6f39d13ff22ace7a957a647cfee2b7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a844cbb-1553-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687915716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687915716, "uuid": "67ff5601-ba41-48b9-afe6-62b14e0029ac", "comment": "Malware payload (Formbook)", "value": "7e0655b12df16284fd2e302cbe384158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687915716, "uuid": "86ac07f7-cdbd-4e1e-b59a-0fa46c1470a3", "comment": "Malware payload (Formbook)", "value": "7dac7deb59d10327aeb7c6bdb7ddb89435a2de26a1ec191a8e15047e545ae736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687915716, "uuid": "c7f97426-7d18-47f5-8c26-fefd8e6a92a1", "comment": "Malware payload (Formbook)", "value": "697b958286c0c63ce1dba60882da28e688cf21ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687915716, "uuid": "4bbeefb4-db73-4e5e-bbf8-e9d288785dc3", "comment": "Malware payload (Formbook)", "value": "e91f4afa8af1997e9ae8c7b7824e5cf7553c9eb313086a30a14914f0a39a6aa94b9b511aa202e28c3bdb9f878d92e8ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687915716, "uuid": "d5e5c60e-404c-4067-ba95-739cec02bde9", "value": "T1244412487AB0C037FCA197B33D718AF1B3DDE837145961BB778183A9373A600461A3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687915716, "uuid": "c0c809cd-16b3-41a8-b872-00d737d9c730", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687915716, "uuid": "238ea7cf-f16e-492a-980c-16b5b1ad3a83", "value": "6144:vYa68LLwDkE4Tc1ZQmevbj1DMH8YmGF17z:vYCLkp4ASZMcYmGr7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687915716, "uuid": "fe0439c5-f88f-470f-9db4-ae84a133ef53", "value": 261746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687915716, "uuid": "88787743-6abc-47ee-bbf4-600daa370148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687915716, "uuid": "ca6fd519-a6e5-40a6-8686-5c84da8f307e", "value": "SecuriteInfo.com.Trojan-Spy.FormBook.816.10496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebd2d94-1591-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687942540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687942540, "uuid": "3be3fb51-da43-4c6d-886b-0814acb2fcd1", "comment": "Malware payload", "value": "368356d8830e119c59dd415958da778b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687942540, "uuid": "fb4ff8a7-837a-4056-9964-78cc15ddcb3d", "comment": "Malware payload", "value": "7db715a9d5d4908c9e82f496b4c97ef9cda802e83e35adf4ff6ef9849bd4289a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687942540, "uuid": "900de779-30e3-4f35-ac5e-569474bf10b0", "comment": "Malware payload", "value": "462e38c67b27f81f5b677f79aec5688d14c3099b", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687942540, "uuid": "ed590ea6-82c9-4210-a3d7-d432e8a86a36", "comment": "Malware payload", "value": "54a8355cd5063968ffd82d3a9ffc2d8d40bb349da61bc7b4fdf0111daa3ae09932274075fefc656c08d5eec3bcbf4eef", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687942540, "uuid": "c5cdd125-6586-4812-9093-0350c983a2ba", "value": "T131457A3C18BD2A37D074EAB98FE484A3F550D53F3922993264DB97954706EA325C323E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687942540, "uuid": "b8282485-f197-4e8a-b95f-1b5d71540402", "value": "12288:GsK0y27+fqziVC0rpbc+QJWIezTMMOroWFMYs:GsK01y1fRncD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687942540, "uuid": "1ed4dc9d-8d1e-423e-813e-4dd132612921", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687942540, "uuid": "6c7a555f-67cb-4f6a-ac97-aa417fb750d0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687942540, "uuid": "5b6c977b-a772-4b52-907e-8841a604c275", "value": "quotation.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2736e978-1557-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687917455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917455, "uuid": "04c0b23e-0108-401a-a370-574c026f2bf7", "comment": "Malware payload (RedLineStealer)", "value": "bfa092d5a5faa405126eb0cf9e23320a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917455, "uuid": "13cdce65-9f7d-4369-bcd4-c4083a26f6b5", "comment": "Malware payload (RedLineStealer)", "value": "7e014c48883a5e5d1b2ec8ed24fc04fb7c1f15406ebc80ba5acea7ab263ecff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917455, "uuid": "28be2d5e-3754-4239-b6f3-7550a154ef8e", "comment": "Malware payload (RedLineStealer)", "value": "2dfddd5499325520f5aa8715afab64963f2f0e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917455, "uuid": "4081aeb2-aa27-4ac6-9524-ed91b4dcb9b0", "comment": "Malware payload (RedLineStealer)", "value": "0d7a5486434038fef71a171e85fdd0b80dbf6c0cacd29ea6938bb8a49786453199a39ac237fbe9df386bfd429f8a0d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917455, "uuid": "790910f6-8c3a-49cd-a7dd-ad6176f53164", "value": "T1650601DCEFBE8EF0ED7981F99CD381D46E4C24B388A44E656A6C586307A023E355187D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917455, "uuid": "533ac94f-c285-4ff2-a85b-752229b608c5", "value": "a95574c9913dbea82b8cba27ffd5141d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917455, "uuid": "70fb0567-d659-487a-a3e8-625e7158b6a2", "value": "49152:CAH928I1HM9wSY8EqRP/ipcQuNbxomXwM3tycP6/pI:/928I1s9wSl9P/ipnu1ymAetbPiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687917455, "uuid": "47a498be-4f1f-4885-b49d-0ef306c447ee", "value": 3759240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687917455, "uuid": "2357097c-6da9-4ec8-ba09-cf0fb1af5ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917455, "uuid": "46460cbb-5d9e-4a6a-b08a-fbb593394226", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7d05ce-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687933272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933272, "uuid": "ae6282cc-7611-4877-a65e-de5cf7ad1e23", "comment": "Malware payload (Formbook)", "value": "02152617a6b0c1112eb544b8925565b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933272, "uuid": "784dcd31-ab67-4179-b154-965f9d2b1c83", "comment": "Malware payload (Formbook)", "value": "7e5db4d74733c673a834aed6ad6e3e312444d8d89974ed47482762ec2f364c8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933272, "uuid": "5743f8fa-32a7-48eb-b430-71442ead013a", "comment": "Malware payload (Formbook)", "value": "b1e97d95ddd1cf116518aabbade6a1484bf97e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933272, "uuid": "5aa52c65-665b-4331-a203-d08e3f7be4ed", "comment": "Malware payload (Formbook)", "value": "f4bda5e86d930f843319c84e70478e9b907f41f0975d94fdcfb370bf4a68be37d2011926fb0f29d074624ee643aef65e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933272, "uuid": "88a306c1-fd48-4104-8331-83049da50649", "value": "T17D524B14B7ECC327E9FE477A9CB7A280033176B7662AFB1C25C8208A68533504F25767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933272, "uuid": "23a4a486-e3db-4c3c-9f84-c4c368d011de", "value": "384:cXxDfLHRLyA/EFBJ689Kjen2+aAHLJJBNvmLfnSb:cXxjL9ydx/KqdaArbXuzSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933272, "uuid": "592b0b36-d33a-4c84-a97a-178aa1d10299", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933272, "uuid": "d8b11ef7-bc99-4a6f-a941-b04371245828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933272, "uuid": "4ae07b67-882f-42d7-89d9-8e0188b5a57a", "value": "QPF_023_R20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db7af96-157c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687933331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933331, "uuid": "832a0829-3a48-4e1a-8399-b7995d38208a", "comment": "Malware payload (AgentTesla)", "value": "81356e10d2160bc08505a91159011453", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933331, "uuid": "7946b1e9-9221-46f4-943b-67353e757728", "comment": "Malware payload (AgentTesla)", "value": "8150ceb72ebe958ee0424f42b26eb134281f42e7188a9f08ccc5025ac70bae24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933331, "uuid": "cb16a65d-2912-40d7-bbcb-c144ee6dc94d", "comment": "Malware payload (AgentTesla)", "value": "87fc1b2a4aca70c7c2e4da17ba08aa6a6d3ca716", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933331, "uuid": "13c7c536-7958-46dc-8af3-82f77edf9cb3", "comment": "Malware payload (AgentTesla)", "value": "778a358ef7d7889df2fcaa9518d3b201e4691011bf8c2ca68c945337770cb7257d312c8a5aa30ff6c00e693399a7254d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933331, "uuid": "c7ad86d7-9ff0-4ee5-9c37-0bbab17e6fbb", "value": "T196C4693C18BE1A37C074DAE98FE48463F554D43F39229A3668D797918706EA325C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933331, "uuid": "1430cfe0-8e70-4c6c-9c90-45aefadec249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933331, "uuid": "df1fea30-40df-4a3e-8079-42e573dfcf45", "value": "6144:16K+WbG7MRynQu82dBmpIea1KlPUhFigp+Vk+7wEuQeHMzw85M5678FM6Qz6JgGz:n+w10BmEEloU95ww+6u6wFM6AQEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933331, "uuid": "ae365aa3-2a0a-47c6-977f-a3adf787584c", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933331, "uuid": "9e4f1d73-14e8-4695-9d11-8876390088e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933331, "uuid": "19f99d8f-ced9-4e61-9146-2c94772603de", "value": "DHL Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85543b5-15c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687963709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963709, "uuid": "519d30ce-18f7-4e51-bf42-d3912357e753", "comment": "Malware payload (Loki)", "value": "caa4ed1363c3e562a1852c962af0dc44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963709, "uuid": "7e200d02-a644-4dfd-b992-d97a916d7a2c", "comment": "Malware payload (Loki)", "value": "8236e441d353893420c1646df09087cfe8d2ea848976ae9f4b1b51f8cb5abaf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963709, "uuid": "b352f816-2bc5-4d1e-81f3-387648e611f8", "comment": "Malware payload (Loki)", "value": "1005c9cc9d82b4e9a28a3b607e9bc9690ed465ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963709, "uuid": "64dd4650-07be-4ae2-be60-df160f9e19c0", "comment": "Malware payload (Loki)", "value": "797ab56ceab8340b8ab8831d245d3d50dda1bf5135ace76abdd2097085604181cbad657a4bb212e8f871c5b0a075624e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963709, "uuid": "49de7725-48e0-4d41-9130-fcb356de0a70", "value": "T145B4120063D12196CDA64876586712781DC4AC1294C49F43C78DB32B7EB7E86FDAFABC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963709, "uuid": "f08decb1-ee72-4108-ad79-95301bcb8102", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963709, "uuid": "8eebeded-5045-4357-b48c-5b2b9e638eef", "value": "12288:9FKBG73lOUG2H7zS8zjDpQ11CmXSbuPlP7ZYa7XU:BrlMa7zbzPpuSbklPVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963709, "uuid": "68cc6764-c327-467e-a7a2-3019219600ea", "value": 509222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963709, "uuid": "0d03e938-9003-4144-9e58-2c16c8e44b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963709, "uuid": "73924426-ec42-4918-a0cd-509932e12be2", "value": "caa4ed1363c3e562a1852c962af0dc44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544333b3-15f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687985821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985821, "uuid": "6b235230-3d13-4b35-823c-104c52f86d41", "comment": "Malware payload (RedLineStealer)", "value": "711748edc57eba5c2f8eae155b0b6db2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985821, "uuid": "07785457-f881-4e22-bb7e-d7467df5d5fb", "comment": "Malware payload (RedLineStealer)", "value": "824802b8de1d5007ebfd0449d1131ef31aec0b5f84fc39fe721fecb9b116007f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985821, "uuid": "6b257a97-4fd5-4e61-ad1e-7dd0f8f32ccd", "comment": "Malware payload (RedLineStealer)", "value": "4ffa6285972fdc3c5c08addd3d880714b2a2c4b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985821, "uuid": "b1034ea2-5b6f-4131-9da2-b4435db791a8", "comment": "Malware payload (RedLineStealer)", "value": "f2868e6e7de2440c37b8da29a567eee873157e39138b446e06a707816b26cd4fb561295946f7a0df1313e3b37b7108ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985821, "uuid": "7ca2987d-eb92-4370-b607-d37b9fd59a2a", "value": "T1A04428372AE1B2E2C48E88F9F490F75854DEDCE3D28FD6C666D4C6A608A0311D45B3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985821, "uuid": "5da7b95d-b45f-4fe1-b328-42da30e2b391", "value": "9ef61842dd257cd165ffcf2d74517de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985821, "uuid": "d24f2135-7f02-474a-a585-c0fab5057b96", "value": "3072:oUdOnuE1wkPUowtyeBpqKAnn3uKQnNBC34Gvk5DO71KsVR5pN8SkH2oWBtawqU6B:oBuE1wY+pq5nnn5pS5rWaPgYdLaMwEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687985821, "uuid": "023fa605-434a-4324-9fa3-97108aa6cab7", "value": 266888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687985821, "uuid": "520b37cf-d7a6-482a-8c2b-45d51ff06be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985821, "uuid": "f1e067e6-86da-4bdb-aac5-38ee1e753bf6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dafeb30-15bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687962080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962080, "uuid": "54eaefba-3e45-4700-b2d0-a5c81672d20a", "comment": "Malware payload (Formbook)", "value": "168a81401f16e7a01e8c51ae761b825f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962080, "uuid": "b43f6d3a-9196-436c-811d-ea1fd536051a", "comment": "Malware payload (Formbook)", "value": "82a7b83bacb8a14b90742ab0cc14fdfa1f27713d634542a3c6a8e0d4940a6a61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962080, "uuid": "402060ec-d211-441f-85a3-270bb8abf08b", "comment": "Malware payload (Formbook)", "value": "e3c7f8b46cac83b9843169f56653b0a6a50a7032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962080, "uuid": "ad2465a1-aeba-4cee-8aed-cd2fa8485659", "comment": "Malware payload (Formbook)", "value": "757a109b1e5984ea3efbfa2abfa6b3044ff9699b1456a9dcbc8213690e4541017cf4e1adf15fa1366f687bb05fb1efb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962080, "uuid": "6b526b38-426e-44f0-bd31-f175120dae6d", "value": "T1C8B4F11C17A9DDD1D1FC833C6891B52C9621A2AB617BBF6135C2A1E23EF27C50B1588F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962080, "uuid": "85f38df0-b23c-4967-9ea1-901bd1f7943e", "value": "12288:laL63LUmfl+JYY2zcH1mqdb1gWyH/pZ1+J831Bs2YJ4RLQ0js05HXgf3:ljkcQA/t+q31GN4+2b1Xgf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962080, "uuid": "48f1d7a4-6290-4a58-ae7a-27ba5ee5c983", "value": 497680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962080, "uuid": "a214433b-09e3-4fdd-af23-18532c0e08f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962080, "uuid": "28a42a63-abe4-4369-9945-fa811556bcb6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ab4d2e-15b0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687955619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687955619, "uuid": "365e1244-24ec-4e0d-9d42-7b103f5ba314", "comment": "Malware payload (GuLoader)", "value": "899eacd4bbe1ad8d2503a9aba92c685a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687955619, "uuid": "e90cbc10-00e2-4948-8ebe-b9b321ab0f96", "comment": "Malware payload (GuLoader)", "value": "82c928bd012d1188bc38674fa48134723ff61a198a47a69b47e00c51efdaee0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687955619, "uuid": "b505e1e7-e5f7-439b-a80b-8630f9acaf92", "comment": "Malware payload (GuLoader)", "value": "e59e6641603f684c14f0d6bdb5475468586ade7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687955619, "uuid": "8d15bb47-5e29-4a63-905b-fa4701638c71", "comment": "Malware payload (GuLoader)", "value": "9e47871a2b3b29ce78ef35ebc0c90db6c2f2242e4ad3d2a930b194ba077bd607a838bdc0dc6f59c9fa9c9bc060b28f51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687955619, "uuid": "72e168d3-dc7c-4d3a-b818-b59f7a77905e", "value": "T146B4124063D221A2CD5688B65DAB01740EC16C2758C45F43878D733A7AB7E85FE9FABC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687955619, "uuid": "eb0a1ca1-e31a-4f35-99f8-c8d40e5be6f9", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687955619, "uuid": "35eafd1e-5372-4862-89c3-cc5a3e46b3d0", "value": "12288:9FKBG73lOUG2H7zS8zjDxQl0LafHNImwYvJLWAba7XD:BrlMa7zbzPxLWfHNI5ELUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687955619, "uuid": "bbc78617-85d3-4774-b8d0-689cdccb36d0", "value": 517563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687955619, "uuid": "892149be-cf69-49a3-88d9-ab819ec59ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687955619, "uuid": "718b023f-729b-4b05-9fe5-8bc53b88bd56", "value": "DOC_PO155362A_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46dd579-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687961904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961904, "uuid": "2a10c27f-ec5d-49fa-af25-e37543a2586c", "comment": "Malware payload", "value": "ca82580b5cc3faca41fed33917519339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961904, "uuid": "44b2a595-8a87-4dd4-b138-ec5af291b180", "comment": "Malware payload", "value": "838ce5b36c1e435c66278140a5ba8c1468f5e844f8cd8dd4aa330c5640b56053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961904, "uuid": "de95554e-1886-4b59-98ef-12c7947e8a57", "comment": "Malware payload", "value": "c9fbf0eb4b9319a891ed4695f664f976a624b01f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961904, "uuid": "8b69d34e-6ca9-4423-8624-6f8f2a070c8b", "comment": "Malware payload", "value": "480c8d5667df2bebdfdd297bb240f7bc7fa3828d40e0d064cfb876327f11b0fc2e72ec5129d3c999a3ce911d16beed1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961904, "uuid": "0414e85b-bf79-4193-adfe-f66f6c5f79ce", "value": "T17AB4E03C0749EEE0E6ADD13D70ADBE3D17A0917B420BBB693991C8F91E963424711D8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961904, "uuid": "d4c52051-8b3b-4dae-9de1-9ac44a0fe7ea", "value": "6144:eRgYoS7lqfhuUs+GO3+LEyEhIJ0iag/Xir0SRhjKFXnWVFSiBCMqGmFNf/6kc4Ae:N0MhcOMVEb8/+0SRIoXQHGAxOJusu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961904, "uuid": "c1f3eb7f-548b-4424-9b5b-7a07fd0e64b4", "value": 501776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961904, "uuid": "64506c4a-37f4-47c5-8de8-803dbb232275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961904, "uuid": "480c1ab1-9b4c-49c3-b367-71526e84a526", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bde6077-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687987122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987122, "uuid": "090788b4-2e38-4c1f-8d9d-916821e53f89", "comment": "Malware payload", "value": "9556f794f43f1144c61ae74fad148d29", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987122, "uuid": "f5704d0d-c150-46dc-adfd-1ed1917eb54f", "comment": "Malware payload", "value": "84e917adbd398c3758c2dda4b348f2604c24075bf4986f37cf11a6e7c6ee44c6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987122, "uuid": "2c428af1-cdf6-46a0-b9b3-0e62a116cd36", "comment": "Malware payload", "value": "7814c5d6fb658f77776a99fd4151db3940c6f6b6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987122, "uuid": "9d95f0c9-695b-4d37-80b3-9db3bb6e0926", "comment": "Malware payload", "value": "cfdbfc5c46ed9d6a32783a515cd1d9abde08f82cc3fe0793aed89d98309a6f461b0b519abfbed466c710c7fc58850731", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987122, "uuid": "b377fbc8-d8df-493d-92ff-10168373349a", "value": "T15A61D1932151B8EA415283BF3D496AF6807FC224955AB045F78C5F9DF9DDE233A8D2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987122, "uuid": "1ac534e6-b518-4be7-9755-99072cb06557", "value": "96:+GTcdc3/luSnWFNgQfBZL0HnmAiBrVMrpS:3/36FwHnmAiBrVWpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987122, "uuid": "34797b32-34fe-4db0-97aa-b8f4cbc6b0b9", "value": 3259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987122, "uuid": "e96b6cc7-af2b-4496-9a91-fa045d4651cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987122, "uuid": "bf20a464-c40e-4719-b429-a95174b6c919", "value": "payld2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac4b55b-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687962022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962022, "uuid": "85b363ec-61ce-4739-9fd5-68797f4c5920", "comment": "Malware payload (ArkeiStealer)", "value": "9ddd7dd141b81a948c7203bc54f13ba4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962022, "uuid": "621595dd-8fdd-4bdf-b65e-a9e54d5ef47e", "comment": "Malware payload (ArkeiStealer)", "value": "853d0ba3e6a2749d9fd18afc0d52a8ab7d5b790f263c8dcf9e465a7135571cf7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962022, "uuid": "a0ec3176-4bf9-4c37-89f8-096838b12a7d", "comment": "Malware payload (ArkeiStealer)", "value": "282e534814b3b5dad268b60a1ef0a93b8a94c53b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962022, "uuid": "c130218f-716d-4fb0-88be-c526973f2d36", "comment": "Malware payload (ArkeiStealer)", "value": "d6bd98e4257b8818535edf3048de0a25ed49c410b2b34414f59e38ec3c0e90a8448b3478246ed52fe90289308ca20d80", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962022, "uuid": "193cacaa-78c9-406a-9df0-0ab44e98463b", "value": "T1EA74F12076D0C472D84685348925C7F8696FB8B1AAA8C9C773DC3B7F2D712C24B7A359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962022, "uuid": "ba8d1573-78b9-4181-9cf1-7377db755012", "value": "f1d9ed365982f922b6db5c4cf987cb66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962022, "uuid": "14a07362-e4cd-44ae-bbc9-f912fc5198a3", "value": "6144:FlIuSf8AdB+K/YTJuEp2WwOEz2YhtI890QJey/:JSf8mBP/cJN2Wqz/tzToy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962022, "uuid": "ddbcbad4-bb4c-44bb-b3a6-2a194a1ed4e3", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962022, "uuid": "4f55c5d3-3696-4a65-b182-e380b3b86d4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962022, "uuid": "6fb92880-d90f-4b16-b3df-e6c4e2764128", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d650e38-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StormKitty)", "timestamp": 1687962992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962992, "uuid": "01371f41-dfd9-4ca6-9110-6930bd715243", "comment": "Malware payload (StormKitty)", "value": "ff6bcb07e1ccea463f17b8c63eb05668", "object_relation": "md5", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962992, "uuid": "e8ae04b8-8a0b-41b5-86c6-383ced13dafa", "comment": "Malware payload (StormKitty)", "value": "8661bf09583ac5882e4183052c4273c267711236b79aeecf3e3fd1ac0da6376e", "object_relation": "sha256", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962992, "uuid": "474cc62c-396a-4405-a14b-4d2a3f4f517b", "comment": "Malware payload (StormKitty)", "value": "7ab6b8bc8c1221933d3a3ef07d83ae1a729924f5", "object_relation": "sha1", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962992, "uuid": "e9a41877-f72a-48e5-8ed1-122e95eb08b5", "comment": "Malware payload (StormKitty)", "value": "913fa276c0c9f634df74ae91436668a9feccfb6d3140e608fc7a97901403e479561fe523ae767a0000d0077d6d56f91f", "object_relation": "sha3-384", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962992, "uuid": "119a4940-7e9b-442c-9aa1-3b458a6c178e", "value": "T10126DBF155ED1BA2327D2DFBE73CCB486D20250295FA7B4BB395C586018BE80D6AD231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962992, "uuid": "548ca33f-f409-4a8f-b645-e6489d3613c9", "value": "6144:vocsGPLYBciclsEveCx0ewEvagIXOJl8zjmQagZTR4RQlLCKqshj4Bz78i7DlxrJ:gcsGP8BciclBeq0envagzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962992, "uuid": "09fa5997-e015-4fa7-8210-b2c1db2a7d0b", "value": 4473118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962992, "uuid": "2fa04e8f-7db2-406b-b610-6561015a80e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962992, "uuid": "e0caf87a-cc13-4523-a672-1583a3fe9c36", "value": "Timesheet.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d940f2-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687963282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963282, "uuid": "2f84bdd1-973c-41e5-aca8-a8114d0950b6", "comment": "Malware payload (Loki)", "value": "bb89c522f6584ccfb9819b31a70767a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963282, "uuid": "affdcdc0-c65c-43ca-b32c-7a72653081d2", "comment": "Malware payload (Loki)", "value": "868e699e1197dd8964c12f89b973ecce755244515c3207063e6fc4218a321b6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963282, "uuid": "2b7a662b-8a0a-4069-bfb3-fe24e32803b9", "comment": "Malware payload (Loki)", "value": "bbe6fa95ac838c0c2a9b10c92fccb657c5625992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963282, "uuid": "876bd81b-0a90-477c-8fa8-3175993905d6", "comment": "Malware payload (Loki)", "value": "7ece1c2dbe01960500e18b1376925004fb1055feb490396e56914561086ce5db4ffd6bee2349e5316740b2781093f663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963282, "uuid": "abb1f1c8-ec31-42db-895c-915ff3c73777", "value": "T101B41240A3D12192CC6948BA5D5B01750EC0AC1794C95F93838D733EBE77A85FE9EABC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963282, "uuid": "0a732d6f-351d-4548-a272-8becb053eb6e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963282, "uuid": "5cb25028-a1f7-482f-9d6d-a67d9d2d7ddb", "value": "12288:9FKBG73lOUG2H7zS8zjDdSwrVPGoYuta7Xk:BrlMa7zbzPdSKYoTMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963282, "uuid": "0ab33d59-2e59-406f-af32-3133234888c6", "value": 517826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963282, "uuid": "18544aeb-03a4-4b37-afe6-6ec8363ffc12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963282, "uuid": "61e1926f-5d1e-400f-919b-1ec16ee369b9", "value": "bb89c522f6584ccfb9819b31a70767a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d433b2-1557-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1687917534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917534, "uuid": "3cd6b954-e485-406d-b065-2d542fd00261", "comment": "Malware payload (LaplasClipper)", "value": "21cbc38776a465e3bee495836a934a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917534, "uuid": "96127051-82e8-4eea-a2f3-2b092fffcdbe", "comment": "Malware payload (LaplasClipper)", "value": "86f5b4f32c68f9337a19363da77d77b6275923da37d2e4144b8f0740620fd3ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917534, "uuid": "47fc83d0-5ddc-4b93-b4c6-ef2b8297de67", "comment": "Malware payload (LaplasClipper)", "value": "b2f6acdae49a84632ef913aea33ccf9949de2338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917534, "uuid": "0fd464fd-e09a-4c1d-bc85-ee37fac4848c", "comment": "Malware payload (LaplasClipper)", "value": "b2163629cd4febaede15b738ece6cf1f475b43f95c1910cb185d281a7fd55b8fc8f6cebe1e8e76faf24f71a39a783656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917534, "uuid": "7318ee2f-23d3-4bd8-8046-1215b20019ee", "value": "T17F55AE9E6DAFC92FFF31F47C58CCD1970999C93784A09CF1AA9ACA5F43804AC406596C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917534, "uuid": "c98a0d26-79c7-4ada-bd4f-25edfab05b51", "value": "a95574c9913dbea82b8cba27ffd5141d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917534, "uuid": "b438f4dd-d751-4700-b82b-d13257911e30", "value": "24576:nrB7SdV5WjDB/ncHlUP0jW62JC1HTK75FmfVcseNPwMv4:nqlnjW5QmPJv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687917534, "uuid": "3118f652-e060-49c3-b24e-fb46c0cc2243", "value": 1347720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687917534, "uuid": "369e86ba-05d0-4d7f-b058-f9a685f3b656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917534, "uuid": "6284cff3-e222-4727-a30f-b37cc7232a4c", "value": "Wallet pass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0ec8b2-15d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687970261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970261, "uuid": "7ec53e9e-8e62-4284-a1a9-48c8ebfc3508", "comment": "Malware payload", "value": "de64a1f4de563006010decc3760e98ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970261, "uuid": "3dca0534-8671-46ec-93a9-06690e6d982c", "comment": "Malware payload", "value": "87d0708f63cbbba7d7213a72baa51da5b383f2f2c73abd2abba0bed42fb08932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970261, "uuid": "11c3d756-54ec-42a4-bd36-fe0ab37d9f24", "comment": "Malware payload", "value": "00d8799b156be9a0bc2f844f79a04d2897cedda4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970261, "uuid": "a7f7c24c-5d09-4bfc-84f0-30e071aea60b", "comment": "Malware payload", "value": "a15daa75019788f0356c71c00dfd6bedb2948f260e7baf9409f6317c557aa6fb38388ad1d1b57b6bde7af94c91277ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970261, "uuid": "9a106347-a806-47a6-9ce6-a63e87c1ce63", "value": "T160351201BBD1A4B2D0610D325A35A7119A3D7D200F69CBEF37D46A6EFE312C1DA35B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970261, "uuid": "a72d35a4-a098-487f-86a2-17a716020f9c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970261, "uuid": "aff0fcc6-8aad-41d0-ada8-a1ff2f887f26", "value": "24576:vTbBv5rUPL6KJaLCEMnDovLtrzMa3oIET+bxP/FiVFGk3:ZBwWKJEMDovSa3C+J/c6k3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687970261, "uuid": "09efcaf1-2c55-48d6-80f7-71d93fbe3dd0", "value": 1074412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687970261, "uuid": "2165854f-ae4b-4295-8c9e-d9515055e48d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970261, "uuid": "e684a19d-7760-4a6e-9102-267838d357e0", "value": "z12POAB67554RTE_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4abfbf-1596-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687944661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944661, "uuid": "f26433bd-70ae-481d-9c86-333f62e3a84c", "comment": "Malware payload (Formbook)", "value": "03edaee7120cbf2752ae82e5eed3f5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944661, "uuid": "ca259849-9161-4111-900c-e1634cd3defc", "comment": "Malware payload (Formbook)", "value": "87f7348a8731af0346cfcc709488d0831a95236f554d2f8a50e12eea1ceb6764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944661, "uuid": "4255c9d7-bf3c-48ca-b0a8-77e0ae01e967", "comment": "Malware payload (Formbook)", "value": "e99dbeb6d15732eae633a61b7cb3f1da1e719b4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944661, "uuid": "83843018-d9e9-4b6d-9710-91d033be279a", "comment": "Malware payload (Formbook)", "value": "4d12c28dc0e3bc58380be3f35545685d6300b6a8e978a7c4e45712b598b84c49aeb1bcfc9c85188ac4fdfdbf2a8ddecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944661, "uuid": "272b31e2-e413-41f1-98c5-dd7cbd6299a3", "value": "T190E48B3C1CBD2A37C035D6A98FE5C4A3F454C43B3922A93698D797A54746EA325C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944661, "uuid": "2f1bc351-bf01-4c00-9851-1507df6e9aa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944661, "uuid": "595877a2-844a-4740-bead-e2473585ded8", "value": "12288:smsIPmu1lQZbMrPHP5c/viTQ+dgbEvae/jvPK3uYK9U8pjDVU:smsu1lEotc/vuFdra8DPKtkUw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687944661, "uuid": "87d30133-7d14-4170-98d3-0089506ab7bf", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687944661, "uuid": "bbc23f3b-11f4-4142-a08a-89107a11cd97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944661, "uuid": "afa36999-aef0-40eb-8c6d-4cb518cb6e68", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.30347.5938.20874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0015eb-159e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687948122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948122, "uuid": "f299b53c-b882-40ec-b865-d14a69f1108e", "comment": "Malware payload (AgentTesla)", "value": "5c561f61a184851db6df9fc71a83b98a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948122, "uuid": "615329e7-c9ee-4914-bcb2-d58ce14aaf97", "comment": "Malware payload (AgentTesla)", "value": "8b2a9586bcf26045ba196d4714d8c628feb5d8eed4604ff82c6e3625b67a9437", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948122, "uuid": "4eecd7ec-6c4d-4c53-a45f-18f80244b549", "comment": "Malware payload (AgentTesla)", "value": "37f35cbe6e32fa1db4df8cd2ba523edf05795deb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948122, "uuid": "7e801228-e372-449c-bc71-472d689b5d8e", "comment": "Malware payload (AgentTesla)", "value": "adcb9caf498d1263902858530c36c1e75863aa0ad653447baa8afb6ce4f8f689f485a8848d3acac5dee2af123261e189", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948122, "uuid": "9f808477-bb1a-4ff0-8af3-094abf49ae6e", "value": "T15AE4283C5B7D9A22C034C6B5CED584B3F2558F3AB411D922588A7BB52762B921DC333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948122, "uuid": "b535d4e8-19bd-41d7-ab27-6b557363ef96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948122, "uuid": "b1a78c52-8d90-425f-951e-a51f928f40b7", "value": "12288:scj6T4Wg0tfComaiEkDoxx7UorpMRlr46Nwa+e:5UZvNC/yxx7UeOlE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687948122, "uuid": "bbb45bc0-97db-4ba5-91e2-2d60dc16aab4", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687948122, "uuid": "91665eb2-0ac7-4f55-b681-367b0a78eeba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948122, "uuid": "f5575987-c9d6-4ba7-a295-c8c5e8b61091", "value": "SecuriteInfo.com.Win32.PWSX-gen.6198.31692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1c80ce-1556-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687917386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917386, "uuid": "5a1d332d-6736-4e96-8684-54e8e5e59bd7", "comment": "Malware payload (Amadey)", "value": "41e5f3911c46752507403696acd2d0b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917386, "uuid": "e133c4df-4bc1-4777-9efd-7fbad2575de2", "comment": "Malware payload (Amadey)", "value": "8bb15fa045c03ba626b91f478aa0b7837f39a9aa038033ef91f0908b02e3907a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917386, "uuid": "ce2327a1-53dc-4e17-b2ba-494bfe532bc9", "comment": "Malware payload (Amadey)", "value": "c48236c710cdab9e656bcbbb04b4316aa906de7a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917386, "uuid": "a72a9c2f-8c76-4443-baff-86168a957af3", "comment": "Malware payload (Amadey)", "value": "02b411ece4a48c16a38df7c30913ee9acdda49d6f8241d1c6c45b3dc3e43e32f40cdd6e9c9fc6816c0b046d0628c0358", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917386, "uuid": "c23209a3-18b3-433c-9978-2716365ea302", "value": "T17116114DEFCF4CB2EFB445F40DD399E48D2CA07329A09D99268D2A6707A427D382197D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917386, "uuid": "cf730219-2888-4489-9002-54fe8e12078d", "value": "a95574c9913dbea82b8cba27ffd5141d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917386, "uuid": "230aa6ce-79ee-44e9-9c13-a5807b680186", "value": "49152:cl4puSoH1bY9OE5fzrl/AgMXvyiIPcZ2c1TWMp1MwIxNTtKtWahLZ3OC:kSoH1blE5fzrygmy9kZ2GDp10JIRZ3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687917386, "uuid": "97f476ed-ee0e-4b30-b310-77a447a3c049", "value": 4088968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687917386, "uuid": "dc68bbd6-0e65-442b-92f5-44f3a891f292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917386, "uuid": "15434fe5-3d95-42d4-b517-af4223640908", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d179e443-15c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687963697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963697, "uuid": "c142a21d-f392-44aa-b324-6630a9625a09", "comment": "Malware payload (AgentTesla)", "value": "eb43687f6f0fcffa1aa33ac8f39cb3a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963697, "uuid": "6b58c69c-9cec-4a0e-a5ad-21700d529737", "comment": "Malware payload (AgentTesla)", "value": "8c7fa17fbd493ee5c1c6cfc4fb662e20ff8f5e41c189808a5fc7d666ce625fe5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963697, "uuid": "0517c2b9-0ffb-4304-8e10-d8d90ea0c413", "comment": "Malware payload (AgentTesla)", "value": "b199b550a6e0e3375d03c5274c833f1d7cfb48ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963697, "uuid": "e13627b1-a6cc-4f16-98d7-3b996d0177f4", "comment": "Malware payload (AgentTesla)", "value": "f6e5802e3ae181e0c0eb744199000876fc153df456e1ee2149416b26ea4fab703e7d54652919b2e5a607e38bb1cc9cdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963697, "uuid": "94928fde-4f09-4f69-b4a1-7550f809af51", "value": "T117E4193C677D9A22C034C6B9CED184B3F2559F3AB411D522588A7BB56722B921DC333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963697, "uuid": "13e3e935-1eb1-4a88-adbb-e4c033c5b0d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963697, "uuid": "13b9823d-da50-49ec-bbb7-c17ee96c349b", "value": "12288:Scj6uvyhWqCZo8J+qrJq/bBALcvrHV2qN8k4lVu7MytBEBy4:f3q8qCjrJkb8cQqxkeMytBEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963697, "uuid": "a99f623b-9b38-4612-b2c6-527ec7e458f2", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963697, "uuid": "14b077ba-4d8b-4827-a366-7f777d2c4730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963697, "uuid": "40a71f2f-7089-4a2d-9ef1-d8a85cb1e7f6", "value": "eb43687f6f0fcffa1aa33ac8f39cb3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367cad57-160f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687996508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687996508, "uuid": "c4ed8e56-b6da-4241-ac03-e82a34d4396f", "comment": "Malware payload (RedLineStealer)", "value": "3436b552b504ecd0be389c2838d3fcc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687996508, "uuid": "08a0171a-dd32-4dfa-be01-f2cafddbe3b6", "comment": "Malware payload (RedLineStealer)", "value": "8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687996508, "uuid": "460c3d9e-33e0-4f35-b87f-88bda78c4e46", "comment": "Malware payload (RedLineStealer)", "value": "569f09b69accf4fcb5ebab702542dc7e87d14039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687996508, "uuid": "b1797ab8-cbf9-4c27-b9d3-81e9f5d2cbe0", "comment": "Malware payload (RedLineStealer)", "value": "18c2060664f945d38121e2a811aded8728cd4242a6166b4984a2286bc87a017bc78ba04d14d2fdff9417d1fea4165a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687996508, "uuid": "5f986b2d-79c3-4124-9f90-77f19fa78147", "value": "T1AF847D4392E17C91E925CB729E1FC6E8771EF660CE497B6522B8AF1F04B11B2D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687996508, "uuid": "cbaa241b-2bf8-4738-9569-0b179bb28b4f", "value": "35c652ec2d2e6b7b1a97d833dcfa5b29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687996508, "uuid": "21fa3438-3573-42f0-8f44-1041a7e558c7", "value": "6144:x252v/kHWAQPsEbbHxL6iwRHQvqBic2gr:Ie/e2TbRL5wRwvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687996508, "uuid": "9cf0055b-3c29-4d17-ab75-81bef0f7cd5b", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687996508, "uuid": "27346635-eeef-4dc9-993b-5415a3da3ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687996508, "uuid": "49be3881-797a-465f-a607-85bf0bae6bbc", "value": "3436b552b504ecd0be389c2838d3fcc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2528f5da-15c5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1687964697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964697, "uuid": "837d6d63-1633-4bfb-8cdd-347363927cb9", "comment": "Malware payload (ModiLoader)", "value": "4714adda6a2fa66c85628fcf4b29185c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964697, "uuid": "3a55417f-6729-4185-a7b2-b3cb04987229", "comment": "Malware payload (ModiLoader)", "value": "900390a8f50e7b8996683d25a591af57297de4b4727cdc83d425c7b010b97ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964697, "uuid": "439f40f6-9309-4378-8bf0-7636426f52b9", "comment": "Malware payload (ModiLoader)", "value": "bf81abd9e809883f043e80b9f9bbdd3ec28be9ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964697, "uuid": "e10c5cb9-eb44-4e8e-be8c-fc353eab7c90", "comment": "Malware payload (ModiLoader)", "value": "d1bab509969091ca006c90d12472fd10a491c2f2e79084dd9c5077d7234befb92f5a4175e7e87bb23a8bef1a9dcf69ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964697, "uuid": "32313fbe-3c97-4a44-b94c-d549fe97cebd", "value": "T18525BF57A5C08477C9B266784F8F96F4BC2D7E243938BC05BAD03A5C6BB635138192B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964697, "uuid": "d5159cb8-2fac-41c4-9623-90bd2aef11fd", "value": "b2ffe640086070c19351a52301f6fb90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964697, "uuid": "287207d6-ffd9-4d92-8910-575c560bfd49", "value": "12288:bWI+n1cF0p4WhPQbXfu/i7Nx29T1CWaXqIov5n0fc8MMvdgV25wqYyEyHcsbOonh:b28tWhPKXf9PvXqgfvcQrEyHFbOwxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687964697, "uuid": "5e9d6e63-2822-479e-9f07-d6181a84cc02", "value": 1019288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687964697, "uuid": "5526f45c-785b-47ca-b0f4-4d38bb450610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964697, "uuid": "fc7e1fbb-2e50-4a52-8bf7-d4dec16f3fc4", "value": "Specyfikacja dokumentu zakupu.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908257f9-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687933094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933094, "uuid": "e148f665-706c-4227-9302-1859ea2e01d1", "comment": "Malware payload (SnakeKeylogger)", "value": "6d1b53e82744198565f72f40b8718df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933094, "uuid": "f7b62868-93ae-462e-b6e6-825f5bb27ebf", "comment": "Malware payload (SnakeKeylogger)", "value": "91f9a73b2cefb5ed67e573cdb63eaddf9e6f4e5b05391fd874b5df71bee8b4d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933094, "uuid": "0816823c-57b6-4203-9242-a78e5709f488", "comment": "Malware payload (SnakeKeylogger)", "value": "fffa28d676df64b209b2598b18da510f2d56830a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933094, "uuid": "c095f535-e6bc-4f5e-810f-3e258081a5dc", "comment": "Malware payload (SnakeKeylogger)", "value": "fa95332c48602b95f9320ab36f6979de79f18908f12a195fa26486ccd9951da1e56b377b4a109438cbc63ee47c84f6d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933094, "uuid": "57cfa781-bdb2-4f9f-8e66-331a9fd7c110", "value": "T1C815D2BB2537D12DCDE871F08432437786B25D258864C6C8F969BFB947BAAB400135AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933094, "uuid": "312ef768-1a93-4ae8-a7ff-0694fd505e0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933094, "uuid": "81c9436a-669d-4cc0-93fa-726917e226fc", "value": "12288:0Lf4hO3ML2IvnGKfKfKfKcGfjsslB+JcWZv3UjVuhbvot4r:oI2IvniiiRjsslB+JcWZv3UjcAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933094, "uuid": "59520f71-dfb1-48cc-aa78-9f07494c93e8", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933094, "uuid": "4b944cbf-47fc-4419-9a46-a5e29cd2b90f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933094, "uuid": "5baf69cb-6c92-4647-9914-d39d98fbfb1e", "value": "R1GH098765567001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e717c705-15cb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687967599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967599, "uuid": "bfe05eb1-992f-4e54-b9b4-d927cc176e3e", "comment": "Malware payload (RedLineStealer)", "value": "0afd8fcf4215d384ac328f01125c3d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967599, "uuid": "8c48c47e-458d-4536-a8d5-d6d0a509d3c7", "comment": "Malware payload (RedLineStealer)", "value": "94ae480fad3a5edf43781bb4a357f95147c67cfd8ac71fc3540f61d0931c5376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967599, "uuid": "e8f74749-6faa-4170-9f44-581ff5fc0a18", "comment": "Malware payload (RedLineStealer)", "value": "ff75d4d1d7e00a2370e0ba02e30869a7188225eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967599, "uuid": "87d274b4-b597-448e-ada5-5a381191e39e", "comment": "Malware payload (RedLineStealer)", "value": "c40f2a6213fb7bf01914efe1f3789f1f0f24f0e041b827616f15076b342ad52cafc7e77826df0182f95683a9955fb60e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967599, "uuid": "b6ac75ab-da29-4637-86eb-7b0f9ef85e11", "value": "T10795AE70F1D0DDFAE75203342CA960200AF39D916195A28D74EFFAACE9B338734D955A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967599, "uuid": "77bc4fe0-323c-4ae9-93da-3749efe2c953", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967599, "uuid": "2a2a1e6e-ea09-4d90-98ab-64fe27889533", "value": "24576:8qYc24Y+xbJXOHip5v8XoodQmhj/l0ZdHvdHdq/UIXmT4l:m4Ye0icoonidPdHd5IXpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687967599, "uuid": "56ab7dd4-f019-4432-9d93-71f62ff37b3c", "value": 1981736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687967599, "uuid": "c92e8fe5-4164-431b-a935-b46234f42052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967599, "uuid": "447616ce-8487-4de8-beaf-333c57449a13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9209be-1595-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687944150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944150, "uuid": "c233ab81-54c6-411e-86d3-09a9cf2f9b59", "comment": "Malware payload", "value": "7158d517fd30a8dddd48cbdd6368746c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944150, "uuid": "5bc236fa-3fb1-4967-bce7-b2604b718085", "comment": "Malware payload", "value": "94d659b104ca9a1bb68aead2bb3130597a4c186d06f895d7c6464219e65bb99a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944150, "uuid": "c164b162-b162-4d1c-81d1-434778024c2c", "comment": "Malware payload", "value": "cd6e0134bdd9ac85b8b8b38721e3d6be6432a6d7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944150, "uuid": "13ba379d-1b4f-4384-9459-6c9144395778", "comment": "Malware payload", "value": "cfae551b00c56599d9d479b0d6a2beffa1369100844d7785f53f0703d2144fcac828f0264f5618d4a1045e859513707c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944150, "uuid": "ca00c358-3094-4e7d-b491-845b753f2631", "value": "T18A05AE10B6D5C937C5AF06B0356FD79B8535BE604B72C0EB93D86A0E0D729D09336EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944150, "uuid": "dab2b516-000d-4527-8098-1860524785b9", "value": "12288:gEZ6QzN5QNoYUkYsw6vAUnBU7qax0EzIVYgvfgAgNYOw3LXB4:gEZxzN1YUFswvEU7J8VlvfgAgNYtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687944150, "uuid": "58582d2f-51dc-4a1a-815c-162ac6bdf67a", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687944150, "uuid": "df0bb6bd-13e4-4012-9152-1c6fbfb80008", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944150, "uuid": "6ba4961d-7c72-48f7-b8d6-a8842961e99d", "value": "referenciadocsete.VOYLQSDWAK\u00b7.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9516bf-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687933275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933275, "uuid": "22ad756d-5db2-4ac9-a726-96eca136150c", "comment": "Malware payload", "value": "cf87c007622f7a91589faab2e98bfacd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933275, "uuid": "f0bd75e7-fd22-440c-9a1e-e1fade191640", "comment": "Malware payload", "value": "950e8cfed90f2e567f20f1ba663e2a172596b96670da2f7b91ead407fc64fa77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933275, "uuid": "a6e81b65-db9e-48bb-a1b6-f53ffe13afad", "comment": "Malware payload", "value": "8a2e30bbd3c14757e2117784b86962b8ad2b3bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933275, "uuid": "fdb46857-1f32-48d2-a368-50bb4b1f14bc", "comment": "Malware payload", "value": "1f6e2dc2c8f1fee51f51f6e3693fddbf6ac6024d54a3313f44872abdda303d5bf9d77ff6618d08551ed4c941a2775fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933275, "uuid": "65c08bf8-d021-4e8d-9c59-37fc84d7fec3", "value": "T1E0B22A19BAFC4623DAFE477C5C7156410773B6BBA712FB0928CEA1AA346335007187A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933275, "uuid": "c0851acc-b476-4a58-afbe-07396d43a702", "value": "384:nnpmKCV1QGiBss8SIukut869Sp6TgEKQMuVU++MIAzU/Y55coklMfocWL5u5Bu5t:nnpmriG7s4uO0SpOgL2U/XAkI5cVkocW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933275, "uuid": "f5adc5d5-db3c-4e7c-a624-6e7967f82063", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933275, "uuid": "e4e50a48-e69f-4804-ac4f-fec8833bb532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933275, "uuid": "2c89e57b-0840-4ff8-a91d-1978ec8d0279", "value": "Quote - 1070226 - 7211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8258d730-1557-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687917608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917608, "uuid": "6900c706-76fe-4395-b685-7292eeb45f11", "comment": "Malware payload (STRRAT)", "value": "1421b13fcff1ed8b4e8ed6d0ec1ef4ec", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917608, "uuid": "ccc0ece6-4c7e-45fe-968c-c2b90ca3a691", "comment": "Malware payload (STRRAT)", "value": "98519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917608, "uuid": "f44bd991-f2b9-4b43-95f3-a568d0e92b34", "comment": "Malware payload (STRRAT)", "value": "7eb847e16c12dc9159e9f8a0b219926ddf9ec401", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917608, "uuid": "349f2b4c-e188-4c81-9987-d811ea3fb0cf", "comment": "Malware payload (STRRAT)", "value": "0c50d3dff1ba6af928f1b3d2f895f65ce66860f000e07c63819209221f8baacd13bf0c6de74ada3fb7e34b7ff7e14921", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917608, "uuid": "2493a51f-17c1-4e01-b954-e08201a83121", "value": "T16063F15B23706C7DD8E70C34654D8137741E7C4A83A6E8CA92BB8A89AD50B8C1BC99DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917608, "uuid": "34c9052f-7829-4087-a14c-5ff906c6702a", "value": "1536:Mf9ewjOD9EgIKgngWmvpkPuH08DdgUFFVk1YSeY9UKihA4X9:CewlKdYPW0AvmYPYTihAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687917608, "uuid": "64911194-14d2-4a36-8db6-129ff220d117", "value": 72294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687917608, "uuid": "7bb698fa-dbb8-4cf3-82b4-acaf2809e841", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917608, "uuid": "ca6d6bf9-add5-4ef5-afba-626e899c3c78", "value": "PO-06028.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203bc810-15da-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687973708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973708, "uuid": "48ce38c3-9da2-44df-8560-82011eaf2b0f", "comment": "Malware payload (RedLineStealer)", "value": "aea0cc5cf15910cc2b77dcae87a6f105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973708, "uuid": "ca8768e4-5bb9-4964-bf80-514a2f380239", "comment": "Malware payload (RedLineStealer)", "value": "99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973708, "uuid": "5a5b557b-3ad6-4f39-b4e0-0254d9e71e53", "comment": "Malware payload (RedLineStealer)", "value": "134b0b6b0afc23bc1a62f8fd1a18fe2732e5ec52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973708, "uuid": "71579d6c-6aae-4d80-9a09-b34441ccdb5b", "comment": "Malware payload (RedLineStealer)", "value": "f814b4c340a9798c50375950e86c7a43c1ad70d1c50e4675bf2ae9875dd5d69d1f4cfb4ab739a3fe1e973aeea4f73532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973708, "uuid": "3e3f21f4-7647-483a-b631-622fdb0c6f4e", "value": "T102847C4392B0BC51E925CB729E1FC2E8771DF6608E597B76223AAE2F04B11B2D173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973708, "uuid": "d77343fb-0b4a-4e10-8e0b-c13541275aa6", "value": "c0781fadd5898c2d1a5d547fc49bcb49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973708, "uuid": "442ee3a2-9a4a-49ca-a2df-c09bf61f7e80", "value": "6144:uSkt5o7kEAtwxqxjB+U/pMU6jQeiDkRkz:Xkt5akX+xq5BlMhjQei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687973708, "uuid": "6bda49e9-4901-4dda-91fa-ca3cd17d1954", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687973708, "uuid": "223dec58-976e-4117-8875-c4e74036029c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973708, "uuid": "0db318cb-129b-449a-b064-bef8f5a256b8", "value": "aea0cc5cf15910cc2b77dcae87a6f105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13307826-15e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687977981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687977981, "uuid": "f668c46d-7d24-4f49-9d6d-9daf78e56837", "comment": "Malware payload", "value": "1fcbbe11c8004a763d0ea4944b92444b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687977981, "uuid": "23b7097c-f3fe-4928-958d-5285fae6f432", "comment": "Malware payload", "value": "999260c0faffc38eb04d9cc07bdddb441f2d315eae34b7842c95a7076eaeb65b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687977981, "uuid": "fb466336-3bc4-4e8b-b726-20e6a07cd5a2", "comment": "Malware payload", "value": "8ce71286ae13aca8774d14a110a6c6beb8d625ab", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687977981, "uuid": "2d44aacd-cc59-4310-b66e-267af9670d57", "comment": "Malware payload", "value": "b34af504e9f72a2e0fec05fe00094233e852501aa56303e54d1cb4bfa9ed68e13ff59223fc0de03ab00d80a154562697", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687977981, "uuid": "69b54131-face-45de-8554-70449ad6c230", "value": "T16E6622DE12E0009FE52941759895AE94A5A0FCB5BB50C36A7E40FDDF6F333E058732A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687977981, "uuid": "5f60f5cf-6f54-4ec5-a0f2-2ec6a47742cc", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687977981, "uuid": "dea009c1-3488-4e1e-81e4-b17ead92d8af", "value": "196608:/aR1FdQmRJ8dA6lXCy1ArqkVpKCX+PrF4ZIeghAE0iGVV:M1FdQuslXrAZYCuPJOIegiE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687977981, "uuid": "253948a3-d008-43a6-bd9d-bada794f3551", "value": 6600764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687977981, "uuid": "f6074e03-7d41-41a6-875c-3316270cb0b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687977981, "uuid": "5190d75a-04bf-453f-a88d-532dfd8a4ac2", "value": "1fcbbe11c8004a763d0ea4944b92444b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc3d8ff-15ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687980686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980686, "uuid": "cf03c585-bde3-48f1-a1da-cc74587112b8", "comment": "Malware payload (AgentTesla)", "value": "f355ce50b15576d20f28eb99dcfed25b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980686, "uuid": "cfba6d77-8c32-4eae-878e-a06896f1fb74", "comment": "Malware payload (AgentTesla)", "value": "999b9220114d400040d6db03f6412a38fbd3f29139c314e95697aaa8ed5965f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980686, "uuid": "c77621eb-258b-46a7-ae7f-6cf11d0006b3", "comment": "Malware payload (AgentTesla)", "value": "83a3069486739e90d8066bf530eb4e97720ac690", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980686, "uuid": "4797a7d9-bfa1-42ab-94db-b1de592e71cc", "comment": "Malware payload (AgentTesla)", "value": "62d4242c8a5a1e87c07a616bd3a706bf5c9585cefc9bc3f3f40749d9636d1a1e9a2c66903a0e8d3466639b66776b37ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980686, "uuid": "5519260f-9c29-499a-98a3-eadc8757ff6d", "value": "T125E4283C6B7C9A22C034C6B5CED584B3F2558F3AB411D522588A7BB56762B921DC333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980686, "uuid": "edf3a5ad-99d4-46fa-b919-8f51cfaf287f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980686, "uuid": "5511a1ff-eaca-4af7-89b9-74488f3fe11d", "value": "12288:ucj6KyhW0oqZJeGGrbT23ZQkbYrqa0VXBKSX+T:jDy80RreGGrbT23mUYrqRVXww+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687980686, "uuid": "79e32efa-91d6-4268-b629-ee9c64a7879d", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687980686, "uuid": "c1cc1c93-d610-46dc-b6a9-28e564aa11c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980686, "uuid": "b49c2e85-3d55-4687-bfec-0cd1b19c39ed", "value": "ISF document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887e760b-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687933081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933081, "uuid": "120c2522-58ec-448a-b447-f39fcb223f76", "comment": "Malware payload (SnakeKeylogger)", "value": "d88d9865edf16de9ed2276332af55070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933081, "uuid": "c70d3dd5-a0f2-48a0-a671-a02ffadc938f", "comment": "Malware payload (SnakeKeylogger)", "value": "9b481ce4b3cb66b4325b09a71c65f202b2da68b1cc9f04cbfd5ad2043cd9ddee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933081, "uuid": "9aaa3a8b-bf01-4e82-86b2-cb8a4a2c87cd", "comment": "Malware payload (SnakeKeylogger)", "value": "2438e949f9d798198a45c700199fa14d29c0db88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933081, "uuid": "51b8c41b-2f51-4196-8d45-ab61d2d71915", "comment": "Malware payload (SnakeKeylogger)", "value": "7c02d6dee6ca604d3a082c2e6f64b4a9cf1ba6e198e989c76f9a56d7278abaaf52a4384afd46281dc4336d01d632b783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933081, "uuid": "4e231d9e-50bf-4db8-b6b4-76a09badb3bc", "value": "T1D4D41254B37E4B55C6FB83F5D261227553BB7EAE7121E32A4ED3B0E84626F084201C9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933081, "uuid": "6df51fb0-e608-4f79-bcae-c4c5fa78f970", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933081, "uuid": "79ff0af5-d4ba-4f65-82ef-a93daeafaa5c", "value": "12288:v7pdvDhH62MmgPFPsbqix4V53Jo9saIdJu49x78lqtM/lf:ddvDcAwOn6L63l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933081, "uuid": "ec0fc027-7cc3-4983-9a92-c1d5b0aab98a", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933081, "uuid": "4945ed99-0c03-400d-aa21-d2c7ead6f3d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933081, "uuid": "51b5c48b-b0f5-41c0-8915-8ad2aeb6f076", "value": "d88d9865edf16de9ed2276332af55070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9757efb0-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1687987222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987222, "uuid": "e686458a-4eb5-4869-9c98-a64c9fe2cf82", "comment": "Malware payload (QuasarRAT)", "value": "846c10b91755f040ecf3957dd1c5a2bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987222, "uuid": "4002f87c-821b-4c59-9a33-4b339df3b6ec", "comment": "Malware payload (QuasarRAT)", "value": "9c17ba1f31d3c5a41d0437818a7d6512775ba991a1d8a03e49f29fc982191190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987222, "uuid": "a35aa37c-7248-48f5-9e57-bf01a37057b4", "comment": "Malware payload (QuasarRAT)", "value": "6269bd0572fcc50bf2ca218dd70d138eef7a9cf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987222, "uuid": "10bdcb0e-cc2c-4d6d-9f25-55dad1054305", "comment": "Malware payload (QuasarRAT)", "value": "e97652bd6f9a7ac5f6a6c2b3b1a48ff55227f85c313e32b9f5ca7dd2eaf976f753f1a0ca2ccb79cc3bd3d11267722ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987222, "uuid": "d18298f5-d73f-4561-8535-c26e7725ab83", "value": "T14FC6335C5AA8F7DDD3A69C7618F9160A97C871E3979BDE8FC9C436200025BC8EB3944C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987222, "uuid": "a82a9f41-fc90-4e59-aabf-51c3cff8eefa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987222, "uuid": "90d6506c-bf2c-456b-8cb5-e1277a542cb3", "value": "196608:GhTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mTtpvFRtoisP0zXUbMpPlv:gTb9epDz4MZZ4RmxYDiScfhHFofP0Le8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987222, "uuid": "b6a9e6f2-69f4-4dd8-896f-334871ecbfb2", "value": 11867648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987222, "uuid": "2867f7a7-a543-4211-98bc-9e377b986b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987222, "uuid": "3f4d27f9-a30a-455d-a680-b5b7198d672c", "value": "me1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53f362a-15f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687986037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986037, "uuid": "0954e783-8a26-4386-b150-3a38e2ced243", "comment": "Malware payload", "value": "66a6a2d389549da1c14c0238b3652580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986037, "uuid": "726f4e11-2520-453b-85f7-9c63b6f4c367", "comment": "Malware payload", "value": "9d662cb0ec1b86f811a46768de783957246afe482a189e4c1015175ae118fe5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986037, "uuid": "174b34c2-a962-4bba-86f4-229d4307cced", "comment": "Malware payload", "value": "b1fb8f7cd2eb4b5e7fc0df2851fb55d919e747c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986037, "uuid": "3fd29234-9121-49b4-91af-a8aea9ae3d47", "comment": "Malware payload", "value": "ab388d172bece335aa14fed199e1d810e4533bf564f9c0920f862cca8be9ae21928a83d49879644b61925c6b47b33c78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986037, "uuid": "73783f7e-dac2-4939-9cf9-848ac6e332e5", "value": "T1ADB35B5B77E530F8E1768238C8A11A4AE776B4760B609F5F03A442561F336D28D3EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986037, "uuid": "90a61e1f-2a8a-42c1-8609-b3f3d11da4f5", "value": "16e4f4472c833bee76a6bec918f8a75f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986037, "uuid": "8a2cdd9f-516b-4327-98ed-939a79dcf357", "value": "3072:4xhNoey5kUfd/wMAVsEAoR/f5HdXRR8BT4:qoey5kUfAVsEt5HnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687986037, "uuid": "3ac3ad84-7146-433a-9747-1933fa60797e", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687986037, "uuid": "4729b643-0846-4b15-8f5d-dedb349f3b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986037, "uuid": "518357ba-c352-4756-a718-5cc31fd9ff58", "value": "newrun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7800aee7-1597-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687945079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687945079, "uuid": "876d9542-9c96-46c3-aef8-a17f5f937b45", "comment": "Malware payload (Formbook)", "value": "8452538e9fcea12d609485df71957fe3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687945079, "uuid": "70355857-7e82-4ae6-b8a7-39a658009922", "comment": "Malware payload (Formbook)", "value": "9eeb0e4740e10819a0d2ecf0a3c7dd93d7ec6348106366f8fff268746aea00e8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687945079, "uuid": "4a4c183e-5ded-48f8-a70f-c1204356ef16", "comment": "Malware payload (Formbook)", "value": "22e8865e36b251846b8380baf7448fa44ecfa92c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687945079, "uuid": "bba6bda1-b914-4aed-998f-231db858b6b5", "comment": "Malware payload (Formbook)", "value": "35d7413df0b39d830f0844f56d8753c76214f3208b3a32f46723282136473d1223aa384ac3aad8b00618e8502f939048", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "txz", "colour": "#5E763F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687945079, "uuid": "9f05d29f-567f-47de-b960-19a1be616757", "value": "T143242382F5BECC4F1165232298D38AF78DBD464B3C2BA55A5EA537C149A558ECC02FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687945079, "uuid": "e61e5460-36e6-4671-810a-9b74f3d27342", "value": "6144:r/kLzCdAqRuqXl2n0zi8+zD4CULy3VndEay/DU/APVl:P+OrXw0qzD7VndnyA/0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687945079, "uuid": "1670141d-e3f9-4bb1-914c-10cdafc3d92c", "value": 228534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687945079, "uuid": "90e31f54-edfb-4b0d-98f8-fa2cbbdaa8da", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687945079, "uuid": "a0b6683d-e6dc-4d14-9cef-13a75d55f74c", "value": "RFx - NRSB-SPCI_QHK_NRSB_SPCI_115R1_023.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0124d4-15f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687986185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986185, "uuid": "34672877-3251-4fb8-9dc6-54a8cd3e4655", "comment": "Malware payload", "value": "4cab036b0b81d9c473e55f7c74249061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986185, "uuid": "17eb51a5-0fa4-4dbb-a5df-05c29fed1d86", "comment": "Malware payload", "value": "9f41e12647a3de5cd9a9567c180cd4c5f11ad8d9c82ad9d6ad64de332006499d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986185, "uuid": "236e5dee-8237-48b2-b4e1-7a9d186cb2b0", "comment": "Malware payload", "value": "2817680bc2f644ef95659aa8e673d69bea7bcf08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986185, "uuid": "ebd17782-af8e-4e41-994e-b92f1a827edf", "comment": "Malware payload", "value": "1a8b857924c8b78463bb8453e06f0f3f9e9370e6c26a513a2b24b6755d195ec4cba5de1497add7db66ff410de2341597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986185, "uuid": "4b5ff35e-ef3d-4397-8e1e-f4d17e186db5", "value": "T197030A11B280C037F8EB11FFDAFE4DB9052CE9741B5A91D361D712A96E502DB2436BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986185, "uuid": "56fb3f40-a89c-4d4d-a5a1-c7abd0686b5b", "value": "28bae790053b6cdaec65a87a87eb735c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986185, "uuid": "99b70d40-6906-40da-ba64-3374ed761c30", "value": "384:iEZPfcQETIXSeJYYSDyciisYps2Ys4DAuD2pZor:pPf5ETIXYGcSYpcAuDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687986185, "uuid": "6b5faf3f-52c3-4e96-92d9-9af738e2c6fd", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687986185, "uuid": "3a272804-5c63-4221-ae5c-76658dfb342e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986185, "uuid": "1fa19ac8-bd84-4361-9457-ef2258778bc9", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38effae-15ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687980907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980907, "uuid": "ec063847-6c30-43d9-a521-85a0ab0c7502", "comment": "Malware payload (RedLineStealer)", "value": "bb5c7f1529fa295c3d431da545c8fb89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980907, "uuid": "63f6f7a3-d7c9-4e2b-9a1d-56ceb665fa35", "comment": "Malware payload (RedLineStealer)", "value": "a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980907, "uuid": "894f31eb-3701-4634-8ef3-3c7afc26d01d", "comment": "Malware payload (RedLineStealer)", "value": "05ea114c68f452268237f37555b7a9d70eecb9f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687980907, "uuid": "64b63cf3-993c-4e29-884f-d9ef3c42ac0f", "comment": "Malware payload (RedLineStealer)", "value": "a4713f2475d3338629731a63810b497d47dfc4d7a4fdd30435ef380305bc71a2e364e8d5f2e216fc542c01599daa4a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980907, "uuid": "b2e50a16-7d72-486d-9bcd-c5dab0d58831", "value": "T187846C43D2A1BC95E9258B729E1EC6F8775DF2608E497B66623CBF2F04B11B2D163700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980907, "uuid": "8bf891ff-8f69-43f4-94c7-98225ce9cf8f", "value": "c0781fadd5898c2d1a5d547fc49bcb49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980907, "uuid": "ad865405-acb5-4448-9fff-f3e61f804ac5", "value": "3072:/VrIMtxdx6vInTNDc8qcewfXDsY/1otnrpU/flUitUIRj5/vlqBZ:hIMXd8vQJpeaXDstBrEflUXIvvMBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687980907, "uuid": "4bee808e-4f74-497c-8d80-07f3b4fa10cd", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687980907, "uuid": "a4a958a5-57ed-4db6-b06a-ad0f3e0d42ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687980907, "uuid": "c01ce3ee-e330-485e-9238-316dd153473d", "value": "bb5c7f1529fa295c3d431da545c8fb89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90818970-15f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687985493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985493, "uuid": "68a590a7-fd67-46b9-9467-136086648ad7", "comment": "Malware payload", "value": "09e61eb3f5951880bf0bd3dd5d11e147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985493, "uuid": "3e8f2b4a-ac61-4b03-8190-f05aed1087bb", "comment": "Malware payload", "value": "a4df733d5bc4d0c50249f228bd100ac4bffd19a330d57363039a1d0f18bd56f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985493, "uuid": "234aefbc-4c1c-4b31-83b1-e57b946e89c3", "comment": "Malware payload", "value": "7c3d7f87a30a11b3c712ceeb6a8ea210bd9b4c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687985493, "uuid": "7034838e-cfea-46db-be7a-3e2666dab835", "comment": "Malware payload", "value": "02673c0ef9482c4e8aac420a0111d331482bdcecdea5e2f99ef863b8d378bcd6effdfbef60acec0b48a224d96de3871a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985493, "uuid": "359eff3f-5087-42c8-8541-4e87a0822203", "value": "T19265F66B7D524CAECDAE03F1C0B70A08AED0C4C61749E1EE35DA93DA974D2CA794D187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985493, "uuid": "aeb8e306-be9a-45fd-8fd4-bee4468cd705", "value": "24576:qhp8fcSXj38idpKHJUeXZYkjm061M95J5p67f8CNTJApJdF8mY1HESHe8Az97LFp:+p8fcSXj38iuJUeXZYka061M95p67UgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687985493, "uuid": "0a7558e0-aa54-4228-8287-4a4c97cb5961", "value": 1512624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687985493, "uuid": "900d739c-6d40-42d4-9265-669a64c9b865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687985493, "uuid": "790cc3ae-76a2-47d2-8c1c-d3777ade6ca0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1418a029-15bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962091, "uuid": "a4d1de31-e687-4aac-981b-0384aadb4b8b", "comment": "Malware payload", "value": "e41a7a81b96e3f20856987c7471f3127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962091, "uuid": "994213eb-7ad2-4f05-85d4-68659ecaa508", "comment": "Malware payload", "value": "a566a538d325ee3da4c86712b3cf4b305d35b2612e2112cfa8f76b511e036e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962091, "uuid": "79f68937-f456-42da-87ca-2dc270663658", "comment": "Malware payload", "value": "4787edb5c9432b3c2011b655032cec5b106628b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962091, "uuid": "2fc42c00-d756-4796-8263-d1463c2f193b", "comment": "Malware payload", "value": "6dad14a9e0acc69bb6b81e93058fcc514e19f5dbb8b18cb3efe3dfae94b3b269cf223e4c3b71168951213dcfec266ea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962091, "uuid": "17ad1acd-4b37-4e00-99bb-1bf2bb000011", "value": "T189E48D28579CED81D866ACB1607FA63F4702D7EAA077CF0B3329D67B05C695343A9183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962091, "uuid": "01cb9732-d19a-4f44-a67c-8abb8ed1c126", "value": "12288:oFxgCxlzICJDQ5GWXs5mgYuD70E7DQBdIIIIIITIIIRJIIIIIoYuj2Ia:onb0uaXszv/QBdIIIIIITIIIPIIIIIoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962091, "uuid": "e4864822-b706-4634-8a8f-b53edd17075c", "value": 692240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962091, "uuid": "8d9f925d-2115-4774-8a53-00be6bb826b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962091, "uuid": "8796d8d7-95c4-425c-b6ca-30606ac155b7", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9e149f-1594-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687943660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943660, "uuid": "add8838f-22fa-47df-91b3-d217e3efb769", "comment": "Malware payload (AgentTesla)", "value": "636857b6931eee103be220c79dc4b750", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943660, "uuid": "8ae6ef86-84e5-4edc-822d-43d6603c752b", "comment": "Malware payload (AgentTesla)", "value": "a66814d509d2386f2dcff674de026b092a29bb4851710954496fe95fb2df8356", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943660, "uuid": "b3fb48e3-c557-45fa-8687-50ff6836a9d4", "comment": "Malware payload (AgentTesla)", "value": "e06e78f031687a8b8999360edff3702217463a36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943660, "uuid": "3a17f64f-755d-4972-bdaa-5810a235fe5f", "comment": "Malware payload (AgentTesla)", "value": "cd251f8bbee1f6f47e7d188ba487510af2150715332be2f2632d231604f15a3173a8c25d089b7c63c366062fae6924c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943660, "uuid": "37b02c46-1d82-47d6-a677-4a73b505298a", "value": "T156E4193C6B7C9A27C034D6B9CED584B3F2558F3AB411D522588A7BB52362B521DC332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943660, "uuid": "ca386df7-ce6d-458c-952f-fac5564445e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943660, "uuid": "435f88c9-65ad-469f-a956-b6313843d992", "value": "12288:gcj6Bzc0WmTY+Gt4zvz8e77ZxEs0kngw3ZKjcTFjeAEIelM3abDy9Cp:1kQlmEt28evcbkgCZK4TFqLliabOCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687943660, "uuid": "c7b8994f-d7b3-4653-b380-0f2ca7d69e5d", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687943660, "uuid": "ccf7e8b5-c494-4d38-94c8-0ac780f822b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943660, "uuid": "8bc20c1c-0a2b-4f39-8453-48a0723eb4af", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d95908-1559-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918287, "uuid": "4c7effe0-7754-4a57-8c56-b5631904c2c1", "comment": "Malware payload (Mirai)", "value": "e4452c2625bc5086dcb09c4651b23b82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918287, "uuid": "42a496f4-ffd9-4710-8ea9-6294af40b81b", "comment": "Malware payload (Mirai)", "value": "a877ea1e0f8d708a708af77db7c53816634c95ffaf367e14e6eace075222e47b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918287, "uuid": "134b02f9-53bd-4410-bb13-faf04ae4da00", "comment": "Malware payload (Mirai)", "value": "3f8600302b5110b1117e7e2c136e37fb93c02bc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918287, "uuid": "c0afc4f4-ba15-4cef-a9a2-6b9d44eea3e7", "comment": "Malware payload (Mirai)", "value": "46c2b2f4e540e81b9aa19607e0788500496dacdeced1f8c837e588300983c64cde23af93b08a95d820f52cad2aab9005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918287, "uuid": "7173c091-2a72-4d61-ae95-9140b7d213da", "value": "T154A2E019BF2886CBC832297495D9F6D21296FCB1F2ADCC092540C15BF5A33A96474F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918287, "uuid": "bbc2db2a-f3aa-42b0-96a0-aa123a84c34b", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTO:M98o08kxofBE+ZkXaEbp2F2TWul0c5QH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918287, "uuid": "09881d6f-b285-49cd-b110-b4bb4a00c50e", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918287, "uuid": "3ce9de3f-0c7c-41a3-8c96-ad0c6b458e59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918287, "uuid": "251b9315-f71f-448f-95ec-a48f2556af45", "value": "e4452c2625bc5086dcb09c4651b23b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c509bb9c-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1687987299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987299, "uuid": "b7706281-3f6d-4aeb-b24b-60f33e00c600", "comment": "Malware payload (QuasarRAT)", "value": "7379781cc4f036054a368f924bf9fe68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987299, "uuid": "2130807e-0067-4a13-abd8-184dba63ce25", "comment": "Malware payload (QuasarRAT)", "value": "a8a85e6faaed6a3dc5687d05b92a9f181e0d986eae1b4e1d731c221990920037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987299, "uuid": "73b9e9ed-b526-4cd2-baf7-0b34580cc754", "comment": "Malware payload (QuasarRAT)", "value": "13d283931f3e43d9249a9006f5595cd759fcf8bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987299, "uuid": "7532c75a-9bd9-460f-abc3-dde6be787237", "comment": "Malware payload (QuasarRAT)", "value": "537f483e2f19f4f06eaeae4bad114bcb3ef5049916c95fba30615fefef685d23a1d915e1381aec2b9afa73dc5e068c74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987299, "uuid": "f3e03cbe-b490-49c1-9216-d50887b4bce7", "value": "T1B8C633684EE4F7EDE7629C7225F416178BDE71A38756CE9FCA8862300122BC4FB2551C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987299, "uuid": "d192c3be-a00f-4b7e-8fb8-e60c1477b178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987299, "uuid": "1a28125f-ede9-453a-9380-0888de54b473", "value": "196608:AhTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mTo805udHXWGQoOcMbY:uTb9epDz4MZZ4RmxYDiScfhH080jNvfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987299, "uuid": "594ea800-8448-4d40-9017-df26a745a569", "value": 11849728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987299, "uuid": "ec4a3dae-3ec5-44a8-822e-30624c42f058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987299, "uuid": "bbcfaa66-b8e1-46aa-8b0b-031837d21b7f", "value": "me4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfd77bf-1585-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687937437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937437, "uuid": "a4fbfc02-8160-4f2a-ad4d-e3bcf5779f0f", "comment": "Malware payload (RemcosRAT)", "value": "c366c3b47042c9b0def644f89e4a6a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937437, "uuid": "0c79eee0-f271-44db-8ce9-8ba2a3d53a3d", "comment": "Malware payload (RemcosRAT)", "value": "a8ae7002d16df08878c864f8cd2f8722dfcb5950372f3b12c88f4e265f2eee40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937437, "uuid": "a32e84e4-6c52-41e6-b4a3-31d759a6be7b", "comment": "Malware payload (RemcosRAT)", "value": "e563f4f262e0d2a72453d59d875af9d7352aa1b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937437, "uuid": "976e56fb-fbba-4fae-8443-7e288ac87ac7", "comment": "Malware payload (RemcosRAT)", "value": "9de269158efccd8639815c44cedd99f1cf2fb804951fae43996cc5e875ef2c336edcbe40d349ca1295b8703dc78e4be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937437, "uuid": "af2aed1a-e02a-42ff-87b9-1c0664003150", "value": "T1B7358C38287D0B66C178C7F98ED58023F3A4953F3825EA295CC367DA1A56F9215C362F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937437, "uuid": "95965f5d-f771-4644-bc67-fe01b37db992", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937437, "uuid": "d3d36975-19f3-4b32-b298-c9d2195bacd4", "value": "24576:9Rf4y2LMJiFx7BMMbFZKVlk6ibLXhlcM+:/4ykVG8WVa6iPX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687937437, "uuid": "96667f93-99a3-4117-a3f0-109bc87c0fff", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687937437, "uuid": "80e2e1f8-4200-4b8b-8cfa-6fbb2b87c220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937437, "uuid": "9a5622c5-2081-4d1f-bf8f-c6e6713d8e55", "value": "SecuriteInfo.com.Win32.PWSX-gen.3039.18432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a945ab4c-155d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687920251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687920251, "uuid": "a2fcc4db-498f-4a26-b55f-e0a46bd6a843", "comment": "Malware payload", "value": "af6667e5d3f46470faa0deb23e588940", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687920251, "uuid": "5c4fa7f9-5c00-4659-85e1-0d714804e6ff", "comment": "Malware payload", "value": "a8dd89101dc76ed165c4aa82e157bdda468db826be0d56c4aafd32f5cf12e0e1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687920251, "uuid": "d159e213-40fa-4c55-b825-c4d2c19ef746", "comment": "Malware payload", "value": "26414fe6d60f78b400bc02bce69177fc5786da77", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687920251, "uuid": "4cf8686d-f29a-4c76-89ac-582d71f3f183", "comment": "Malware payload", "value": "1dfb8773dad170a8111db909912788c6600a8809b59dc5ee6f08caaeff9b6040aeb27019e8c910de2331bab239d81eb5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687920251, "uuid": "eb8e9256-981a-41b7-b6ca-7f58ac1e2dcd", "value": "T1EC16F147F349992FD577C13609F70636A2964C0A8B43D7173A18B26C6EBBAC05B85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687920251, "uuid": "84bd20ce-a328-4787-b2e7-8e9dab6930bb", "value": "98304:4E7t/jXkAkfsQnB84F9h/2L0M4TQ9MGqo2iePdlUAqr:4ER/4HK4fhYwWHo3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687920251, "uuid": "4624cd40-f85a-4fbf-9362-532b99a8228e", "value": 4209388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687920251, "uuid": "3ab97fdc-100c-4c5d-859c-559632e3d88f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687920251, "uuid": "d489434d-d9d8-4a5f-8cb5-b1db9f5144b4", "value": ".apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb3b6bf-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1687961916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961916, "uuid": "ce25a267-d8c0-4e88-b496-fa4408b9961c", "comment": "Malware payload (QuasarRAT)", "value": "97cafa10422a4f6810ab44ec48bad092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961916, "uuid": "c5e0c89f-fdd2-46ba-8e6d-5fb7e43d5a90", "comment": "Malware payload (QuasarRAT)", "value": "ab8674f0baf9cc51bdb639626664be6917a3682aa7ea25b7c233b673800513b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961916, "uuid": "248b39a9-d76d-4667-9b4e-2e68b780de0d", "comment": "Malware payload (QuasarRAT)", "value": "5dba9beed50520095333165ef9f54a98f975ef7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961916, "uuid": "7fe4fe45-ccc2-4501-abf6-09da30c19faf", "comment": "Malware payload (QuasarRAT)", "value": "25e989f3cc561d6bfa9c85ed36b06c13595e1ea7f0a5b1660dc11694c0a66fa0436940e885618aed555215eb1b141bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961916, "uuid": "103d68c7-6df8-4030-9d20-35ff7cfe3bbb", "value": "T109E4F1542B96AED0E7998538FCBA596C56B081BE811AEFBB38D464F46CC634073052CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961916, "uuid": "d17d9d00-76d6-4e48-b678-a632aac88682", "value": "12288:gnPRHDHwAvV3eFnr3xEf2CBJDNd16u8j2hZWQLdovThkXbemC:MHwsVM3xE+CBV1JQQLdov14emC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961916, "uuid": "397895a6-6ce5-483f-88a3-6929c0efe867", "value": 670736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961916, "uuid": "b4ecbd18-aee2-41bc-adb4-ee9a508fc824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961916, "uuid": "81c3d191-6908-450f-81ce-f90b032c0fcb", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590bde14-15d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687969508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687969508, "uuid": "4ba9544a-ccb2-438f-924c-c9d0a551f3d4", "comment": "Malware payload (RedLineStealer)", "value": "1d012b9de099f3ade1c70ac9d084067c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687969508, "uuid": "5431e709-8229-4685-b9b5-bc9f4ffd3710", "comment": "Malware payload (RedLineStealer)", "value": "acaa807a6fbac7521256116f532d057a15f0b71db869b235576ddf62724158e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687969508, "uuid": "55315928-5908-48a1-8144-d9e71c2abd16", "comment": "Malware payload (RedLineStealer)", "value": "0dc2116d5634664f18f9530df0e68a7f4b93117c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687969508, "uuid": "85dc0fea-e164-4b2f-ae72-1d5ea631596b", "comment": "Malware payload (RedLineStealer)", "value": "f823889bf36c533d51f87c1648eaad0be04cd2edc052ac2f8d24fa2c54e9ef74d3b3790f41799fbb21e474ca3e1c0918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687969508, "uuid": "329aa49e-571e-4ae3-8450-b94f4b0455b1", "value": "T1175522427DD1A8B2D53308365A341721A83DBE306FB9CEDF63D46A5EDA215C1DA307B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687969508, "uuid": "44dc3b8d-f461-4394-afdb-bb58952aaa18", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687969508, "uuid": "bbf59973-4525-455f-b887-844a12eb08d0", "value": "24576:2TbBv5rUyXVmlh6Bb024jC8TEa/oWV/XkM1KLtDW5C21dWTHknaW:IBJmloBo5jN/3/UMQLtDW4oW7KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687969508, "uuid": "c843a2d1-7a9d-43af-b27f-b68051659390", "value": 1359491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687969508, "uuid": "74a1c8d3-d86e-452f-9c9d-7d4243d8a5b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687969508, "uuid": "5d781f26-ae9b-4dcb-b2b5-565bbfcd5809", "value": "1d012b9de099f3ade1c70ac9d084067c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d11c5c7-15c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687963851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963851, "uuid": "26dc84c1-352c-4c17-800d-8c751a60ccc7", "comment": "Malware payload", "value": "e310e98236bb5f6062114f96a59ec15d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963851, "uuid": "a1877831-cd80-4269-b4cf-5f286c83debc", "comment": "Malware payload", "value": "ade55481797d0c7bfdaaea3c7b6d14771c902e825b4f28bd29bd669d04d661df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963851, "uuid": "479cd4a3-e17c-4b68-a2a2-df8dc869db26", "comment": "Malware payload", "value": "38b288963cc5f212b31aba235db94432fbdc5211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963851, "uuid": "998d763a-70d0-4a57-9eee-645433b004f6", "comment": "Malware payload", "value": "29e0eab9ee28b46744427d817c127657d9133bf36e51be463082e9e03fb74d072791bd464567eca2defdcc4c13b15369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963851, "uuid": "862394ff-bb5b-42cb-8aba-e173527dd50f", "value": "T1597622BF57AE7172C8427074880A92837549D48D413E8C617FDB1F8EC65ECAB258EFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963851, "uuid": "771e6326-defc-419b-a939-e1fc91ef95d2", "value": "ccb2cf295a891890865d88d1e63e8f2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963851, "uuid": "3f7212db-2bc9-4838-857b-e7b9d77fc0d7", "value": "196608:cTEcVnJULKrytYcJX7Nfjw9cI1qyz+6weSn5B:4EcVnukcJLtlIwqwemH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963851, "uuid": "7156c66c-72fb-4250-bb98-652a22e7d7f8", "value": 7313150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963851, "uuid": "5f3b6599-24be-4c66-b8e5-b85aee7ea627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963851, "uuid": "55f6cc36-889f-4661-b4f8-9eb44b22ec1f", "value": "e310e98236bb5f6062114f96a59ec15d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973e1c4d-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687933105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933105, "uuid": "6d0bcd2e-f11d-4d39-814c-689cef2e40ca", "comment": "Malware payload (SnakeKeylogger)", "value": "381db1a17a7fd5d7469f9b377a15b2d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933105, "uuid": "976aa42b-cb82-4f5b-8304-9e2296751041", "comment": "Malware payload (SnakeKeylogger)", "value": "adef42f6ccf0471ee589741eeba2fe00803cb2411f3bbe71fef971b201a8ac62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933105, "uuid": "687b973c-a49c-4290-8bab-33cbcc0e3205", "comment": "Malware payload (SnakeKeylogger)", "value": "8f73f771e638b22f6be0c7e9dbd4efd8547d507c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933105, "uuid": "bcdf7012-5edb-416e-ae7b-941b1436aea2", "comment": "Malware payload (SnakeKeylogger)", "value": "0e0517697dcf35fbbfec4e5efc54136363b06cd3e8a98d56176a7dc339adae4f2199a094bdb6ae6edacaf4faa6369724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933105, "uuid": "5a2b378e-d23e-4681-9bd5-9add87d0ceee", "value": "T169D4124862BD4B22DAF7C3F954A22630037B7E9E7561E3AD8ED370D8572AF050211E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933105, "uuid": "65f14625-e9b5-4188-9b15-c0f4e876e9e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933105, "uuid": "3be186d8-1bef-4776-a1b5-58386e41c507", "value": "12288:t7pdvDhH62MmgPFJMRAXpcXVtlFciOw5aFs6lnRpTJcECqo/7UIUdpN7Q:zdvDcAwIrXtFcJznpTJcqs7rU7Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933105, "uuid": "4794dbe8-100e-4329-857c-5a842efdb124", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933105, "uuid": "a4d62c75-f61f-4a1b-b0ea-996bbad9c452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933105, "uuid": "b302bb19-2649-476e-ae6b-54f7bc979a4e", "value": "381db1a17a7fd5d7469f9b377a15b2d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9307a18c-157d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ShortLoader)", "timestamp": 1687933957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933957, "uuid": "0d8a3ab4-babb-4c6f-8584-6cc0aee16c80", "comment": "Malware payload (ShortLoader)", "value": "6af4d7392a5a352ae8d03c2ea4ee0db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShortLoader", "colour": "#505EF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933957, "uuid": "f4b706ba-1a07-4a5a-8c90-747252c0c569", "comment": "Malware payload (ShortLoader)", "value": "ae189d920817268474f322f4a27a14f7c87e39e9729493d6092b28953a0c2483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShortLoader", "colour": "#505EF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933957, "uuid": "7b2fc981-fdb6-4397-ab20-eea4d14b1db4", "comment": "Malware payload (ShortLoader)", "value": "70d08574af75b116ad1b711b356c289e1a2bed7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShortLoader", "colour": "#505EF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933957, "uuid": "eedac856-fa27-47ff-b378-2a092e92ecaa", "comment": "Malware payload (ShortLoader)", "value": "e69b2289fe3eb91fef64af9c556a5f5d84319f84ace2a437ec0ba0c1f3a000eea76ff5bb91d229607c88d7a900df0b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShortLoader", "colour": "#505EF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933957, "uuid": "e641850c-6999-494d-90fb-e6430fc50757", "value": "T1F6F1D706E7E58333EDBD067EA8B3175053B2E7264D13DB1A58CD811A9C633084A92BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933957, "uuid": "459ea81f-7562-4108-90ef-44ea2902ca0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933957, "uuid": "b33c00e9-188f-439b-9bcd-02e90ef423a9", "value": "96:PyJOuzM2WGKoFR3kdLKozt1sfC7G2zNt:OWj83GL3sXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933957, "uuid": "27a55a2c-37fe-4dfe-bea4-71131c43ad9d", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933957, "uuid": "8e093792-4072-4146-bf45-ba33e112d7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933957, "uuid": "4eb20f76-6bbb-455d-bf7b-67d216ffacd2", "value": "6af4d7392a5a352ae8d03c2ea4ee0db4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8735b5-1554-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687916369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916369, "uuid": "ff4a5c1a-5971-48f6-b2d4-3d0b4e075269", "comment": "Malware payload (RedLineStealer)", "value": "3aa5a64a437189f0d894f759b711ff99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916369, "uuid": "8d718110-3b35-4192-8a7f-b0b7ed9dcd0d", "comment": "Malware payload (RedLineStealer)", "value": "b2f3b4621b7d66a04a529c6c68d8de5604bd98a21ea06d08d34ef408a75ca96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916369, "uuid": "73ab889c-0fca-4150-a858-888968298929", "comment": "Malware payload (RedLineStealer)", "value": "60a3245fa87eaa5788454b81867894d9f591c08f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916369, "uuid": "d1a091c8-b38c-4f1a-80bf-6faa9edc776c", "comment": "Malware payload (RedLineStealer)", "value": "2e73e8813bec12b06931b35ec967d6ec9141e023f64050fb23dd209398cff82489fa447d9351b7480d468f20fd7e855e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916369, "uuid": "49c675c3-9401-4a53-a15d-4ae7a9231f39", "value": "T1D2846B3392F17C50E9264B72DE1EC5E87F5EF6628F2937A622189A6F05B01B2C173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916369, "uuid": "a762ef81-6406-489f-931a-2aa0f73468cc", "value": "ddcdb1c08a1de8d683d90430b0a24222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916369, "uuid": "1884b1bd-9df2-4e94-91de-725d39a09e53", "value": "6144:ItPw7FO8ePr6GX4RGo1RfVzDk3Fh30PI2:It4FO8uihRNzA3Fcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687916369, "uuid": "04e41af0-56cf-4f26-a16c-400043a41312", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687916369, "uuid": "13d5290f-e703-447e-b413-c6e091b758f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916369, "uuid": "261730a6-d10d-4c99-b749-cef4a44a6a26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1380aeca-15f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1687984424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984424, "uuid": "76ffb614-2b53-4035-b661-96987b9b7a4f", "comment": "Malware payload (Tofsee)", "value": "944655b3865bcbb0d9dd0f90467094b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984424, "uuid": "00bdbb8a-7701-4d63-8107-831fb25b3051", "comment": "Malware payload (Tofsee)", "value": "b2f5d09c0f4f4ad390c939e6d2d4af2e1155362a409d20a784826ec0320afadb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984424, "uuid": "41cfc791-a2b9-4756-b7e6-3f99dd90e3e6", "comment": "Malware payload (Tofsee)", "value": "50ea89599994771b3127450b61db53e98f08cfe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984424, "uuid": "b4081eb3-5fe2-4072-9e23-7a9b0060d5db", "comment": "Malware payload (Tofsee)", "value": "505be2b90324cb0cc86fd2e67e757bd9cbe0703a94e368a06c731b65a8046ae98ea67abe4da0c93e25c79f7680529212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984424, "uuid": "e8658b04-2e15-4e12-883f-0ecacbcbe9d1", "value": "T15E643B4352E1BD90E926CB729E1FC6E8771DF6608F497B6722389E6F04B11B2D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984424, "uuid": "f9403533-2a8b-442a-ab51-e1930c97d414", "value": "35c652ec2d2e6b7b1a97d833dcfa5b29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984424, "uuid": "8febd5d8-8f4d-4e66-97c4-22aa17f3d835", "value": "3072:z8maj+qOCfqgT2o1YZtmapcpjl6L4vX5vj5P1oir:zijeCzT2CYZtmWvLu15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687984424, "uuid": "7d9fffd3-2656-4dbe-9c2a-0a1bb2ac6881", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687984424, "uuid": "c6128c60-fbe8-46cc-84fd-8ed34997c149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984424, "uuid": "c8474dfc-7341-44f1-96fd-4fa244133100", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef2ea40-15d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687970323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970323, "uuid": "5b131fa3-27f4-46be-a620-b76cbf42402b", "comment": "Malware payload", "value": "0a520b2eba6a6764a484153f3e1df195", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970323, "uuid": "5652aa57-67d3-4c8b-84e1-3a1fc5af78d4", "comment": "Malware payload", "value": "b31a3f37216267f1002b76992e0589c48a07cbd33e465d20f2cc3e848c015155", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970323, "uuid": "194ae560-a641-457f-80dd-9cf09900f975", "comment": "Malware payload", "value": "6730b4718f2200c9dddb6d591d4605c03344bf59", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970323, "uuid": "8f18b319-2abf-4cb8-89c7-c412d2ce5018", "comment": "Malware payload", "value": "1d400313f2ff96c7565ddd81ad4485d0086d7575c3d6bdeeab09877386f7c97ac81396c36ad4860f904c21a75ea5c3c8", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970323, "uuid": "6e54d9a4-4b15-489e-a20e-684343171455", "value": "T13523733E6C96503B6D72EA51C9D025B7FB19A66F350E6C0950C3834A45D3A83BBC03AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970323, "uuid": "5c07d45e-f6a2-4cb6-9246-7398a0ceb3fa", "value": "768:RiOKFUiOKFRiOKFXiOKFgiKiOKFNiOKFsiOKFtiOKF/YiOKFA:AOKFVOKFAOKFyOKFl/OKFcOKF9OKF8OF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687970323, "uuid": "a6a83b51-cc76-4fc0-988a-8b8c9bf11558", "value": 48498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687970323, "uuid": "e716e091-5011-4e2a-a35d-55fecd10b2da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970323, "uuid": "e6713b62-4205-4294-bc4d-a115c179f3c6", "value": "rdtl.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f446fafa-1593-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687943569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943569, "uuid": "56bcaa35-c176-4a1b-b801-7577550ac821", "comment": "Malware payload (AgentTesla)", "value": "7e6777eca6482dc667f428a01e0ccb9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943569, "uuid": "58a79936-d6df-45cc-83f9-c584af70598f", "comment": "Malware payload (AgentTesla)", "value": "b4a2047cf3cde6ed72aee46e51426a4aaa2b1ac23daf8cf4bc81bdcc7275204b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943569, "uuid": "67192c54-a850-40c6-b59e-7d5d8d72761f", "comment": "Malware payload (AgentTesla)", "value": "97f1b41bd5f38054824e96a8e6c3c64e3633f8e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943569, "uuid": "c19f1373-0c4c-42fc-88a9-5738f2ccaa59", "comment": "Malware payload (AgentTesla)", "value": "f128135a32084377008a8cd0753753592717cf8016eccc298196239b00a003de59d02befa557a4c77d1066fbdd0a0bc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943569, "uuid": "b5cb089a-c058-47da-bfd5-aa500ee8fbfb", "value": "T107327D768AC528AFE30BA0B580A1A107F6A431D3932BBD0E7A34F569C5751ED7B01395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943569, "uuid": "85efb5a7-88f0-4bd6-a478-0b7ffa64b811", "value": "192:kMoya0NZeML8yMHW7MHARgZVPCK44AG9xXSJ+Ej75MJJYoMKKwzMUKnNMEMJ3MHb:kMoyXZeML8yMHW7MHANK4499xXSJf75z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687943569, "uuid": "0e6dfafb-49e6-4148-8bb9-3a0a61917d2b", "value": 11082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687943569, "uuid": "db872e2e-e851-4805-b345-f593e189ec6c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943569, "uuid": "9cfa3785-8e6b-49f7-8329-486f84d8cf88", "value": "EURO PAYMENT COPY.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b579d8-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687987115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987115, "uuid": "03f8e4c1-19cd-4e81-b55b-514c0ffaa3e0", "comment": "Malware payload", "value": "5b09852f737a7f9518f10a1232f7bd1d", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987115, "uuid": "e9063565-a2fa-4074-acc1-506db3c972ac", "comment": "Malware payload", "value": "b5a4977adcb122b2972b3e4566beaf85385bd12ceee14e594d4432e0195c5710", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987115, "uuid": "cb398456-e704-48ec-a9fb-79a9d6ddd51c", "comment": "Malware payload", "value": "fecfc91032af2000bc1bdc4b22b639ac5d7c48b3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987115, "uuid": "2dda8231-5f97-4628-96f7-13ae8e6066e6", "comment": "Malware payload", "value": "87478930ef2d20315dfe45ed94f05678f1296c31594b00f7feccd8d802dac35fe06e1a6dbae8d913972669c0cffc09f4", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987115, "uuid": "36e2f2eb-3af3-41d7-b1cb-8147020f8c23", "value": "T1AA619E932151B8EA414283BF3D996AF7807FC264955A6044F78C4FADF8DDE633A8D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987115, "uuid": "cbf5ee0c-59e0-496d-b5ec-70ce38bcb5c0", "value": "96:UGTPoqfuSUkWvD+CfRJL0HFmAiBrVMJUo:ZQXpv4HFmAiBrVaUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987115, "uuid": "b7017ce6-9afa-47c3-8647-4895d077bcfc", "value": 3234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987115, "uuid": "26950347-fa94-486c-8e80-018a72bead82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987115, "uuid": "be87ab8a-8c1c-4cf6-b664-4816f8ebf41b", "value": "payld1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4462444-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687962816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962816, "uuid": "4d545668-9b28-4a94-b09b-3c29938dec91", "comment": "Malware payload (Formbook)", "value": "493ece4e6645ac2e36f2342867354f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962816, "uuid": "109d430f-6a5e-4eb7-b4e8-e1cc80237f89", "comment": "Malware payload (Formbook)", "value": "b5dc27382870178d15ef052c2938fc32d4717b793bf9e726e7583695231bb2c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962816, "uuid": "82b32e14-80f7-4136-bec7-c1665fa7b368", "comment": "Malware payload (Formbook)", "value": "73968fce8fc749147b960f696eed58dee37adeb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962816, "uuid": "5d2aac8f-767d-47c9-9a6a-f944abb583aa", "comment": "Malware payload (Formbook)", "value": "0ea3a4010a2748e599dcf3605641ae88f4bfe5f45ab9cd2c753b304a44870d9f0f968f37fb07cb0cdbc5e7d2431f0646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962816, "uuid": "0461289d-dab2-4c7a-8b6e-0ac6c57d1699", "value": "T1F6E4383C19BD6B27D034D7E98FD48023F664847B3922EA2658C297D54756F922AC323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962816, "uuid": "e2be1749-e827-43ec-a251-7ba4d4abdbaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962816, "uuid": "e545eace-c4c5-4a99-bca1-16433fed4059", "value": "12288:WmRlKPV54j4gE5innY+2lYt7ImWBMFYdPNXU0no1hooweWqZPZD:cYYinnYE8WYd1XxwBwexPZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962816, "uuid": "f09b228f-a992-4112-a04b-4cd75b29f4d8", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962816, "uuid": "9627edb7-2d01-4932-849b-a82a99f8b19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962816, "uuid": "0f6d82d2-9788-4b70-b328-b9099dbfbb1c", "value": "SecuriteInfo.com.Win32.PWSX-gen.16168.8416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b34d11d-15fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687987497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987497, "uuid": "bdb5384b-fbad-47f9-8035-23a07e6d1cb4", "comment": "Malware payload", "value": "674073f8cb3ce51e426aa3767963c183", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987497, "uuid": "90e9149f-1118-4939-9110-7775a9d2a28f", "comment": "Malware payload", "value": "b759ccb1655dbb43362e16f0e2a3a950eddefea7a88235e4a828c45a2d95144d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987497, "uuid": "9a9e75c0-7772-4e58-b4f1-c34dd16ef61e", "comment": "Malware payload", "value": "a02d0cc45e8894a07e2b4bb19ca377751a5802d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987497, "uuid": "6ccea273-9bb4-4fc0-a02a-c01b95282e0a", "comment": "Malware payload", "value": "8165bd5e52db36f64c0696d70c8993a3a6b9f3fb5cb5a0c39b0908c477420795855e8517d13c260fd0bd250303deacf9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987497, "uuid": "ac64e523-5e07-4581-87e4-66124ed78a03", "value": "T15DE061DF0C12D44BD51430F0E4F2F14C14DAC36BE8544D5064C0047993C4BEDDC45765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987497, "uuid": "1a09d2b4-b55a-4458-9efc-7440a2d0f834", "value": "12:kxRBWJRHkB18WJ8XAqJm9P7AgYDkMxOAgLq:kTyRHSxuY7AZDkMxOAEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987497, "uuid": "80a4a6ff-e8d8-4af6-8bdb-988c56c4f91f", "value": 397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987497, "uuid": "ecd41daf-fc60-45c2-b3ca-9e9eb1ea5968", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987497, "uuid": "64406d1e-941e-4743-a512-030009b68a8a", "value": "supppee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca920d9d-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687935768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935768, "uuid": "87744a74-5d66-489c-8a54-c0e3683a7383", "comment": "Malware payload (RedLineStealer)", "value": "7a239c74c129efc307f98fd62a605bca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935768, "uuid": "d838b655-6a19-405c-98fc-02f38ba4afa2", "comment": "Malware payload (RedLineStealer)", "value": "b8254f6435b125aa27f14b554aa14404d3bb1a55a9e659acd4eb22fc6e8abb80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935768, "uuid": "9839796b-4581-4803-803d-e8b3a72cacb7", "comment": "Malware payload (RedLineStealer)", "value": "9aa2465338986007bfa61e91d923f8327d61fd3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935768, "uuid": "b6a3b113-ab65-440b-91f2-7de5042c333f", "comment": "Malware payload (RedLineStealer)", "value": "e68476ac08a11d8d152d36e428a332eaf067ab1f41d552200813f9a2aa9128ef45bf24e35a68d46487c2428cd1b2034a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935768, "uuid": "156e7b6f-5ec6-4fdd-b6b2-b4e596e47a5e", "value": "T1B455F102FEC88E41E2754030DA94594AD725E52752A29F2776DEF30B0FBBE50E90366F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935768, "uuid": "8bfdfef4-baa2-4126-8cdd-9e75c08b2e5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935768, "uuid": "7c06dc69-5a99-43a5-8a63-2f1a0d64335e", "value": "24576:8wZJ5F3v8KsyIoOA47b1NNT3bVDq+1F6eQ+9iAi+C1BLHgZpJk2:hZJ5XsJozOdlDq+1F6eQ+ivLHkJk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935768, "uuid": "36e0ae6c-648f-433b-a4ff-a472fa18926d", "value": 1302688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935768, "uuid": "579032a5-1d54-4525-afee-060826518383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935768, "uuid": "772f1c75-dc7f-4084-939a-474b921fc334", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074dd0b9-1587-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687938018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687938018, "uuid": "da6788e4-76bc-4005-8f51-d3830fba0e4e", "comment": "Malware payload (AgentTesla)", "value": "371bdacde39dede1227b620e61b78ff3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687938018, "uuid": "e7a23b39-0777-4674-8be8-d6b8e98865d0", "comment": "Malware payload (AgentTesla)", "value": "b97a932fadd096c350b870e0a0d9865c0c3a0d28f236575509fb349e347c92b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687938018, "uuid": "d5681900-e3c9-4405-b55f-dafc8b179f7c", "comment": "Malware payload (AgentTesla)", "value": "abd4c7feb4357c6bc72a18cf36c9e953d398116f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687938018, "uuid": "6b989d9d-2089-407f-a710-251d5bd11e9a", "comment": "Malware payload (AgentTesla)", "value": "45508e4251c3bbcf751bd0c37497496b295da90f7be2c257e2c63b28aeb57b612d9354681eb6da3f3ec3e89fae1a09e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687938018, "uuid": "9ee21cf7-fdfe-474f-8573-b570e73210c5", "value": "T121E4183C6B7D9A22C034C6B9CED584B3F2558F3AB411D52258867BB56722B921DC333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687938018, "uuid": "ab1b45fd-767b-4f19-a6ab-97962eba4bfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687938018, "uuid": "45443396-fde4-46fe-80c2-cc6fd6b58cb2", "value": "12288:zcj65qWT0l9tHn5CTZLOUzAA67m/0iYIj64YP6LCm/M27:Q6H6tZCVF67QBNj6HPAV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687938018, "uuid": "7bb13102-6009-477d-8780-7576cb14a532", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687938018, "uuid": "b0c37fc8-41ed-4ace-9682-1d7e9666ae62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687938018, "uuid": "944982ac-6b85-4588-97cd-285f108abb6a", "value": "SOA 6680085911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a739dcd-1559-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918293, "uuid": "38877c1d-3b88-4ba5-9e14-0b361acf11aa", "comment": "Malware payload (Mirai)", "value": "cdf6c5bcf3d15590ecd99fb50137c615", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918293, "uuid": "c952464a-3ab1-466c-b4c6-59ebee40d9be", "comment": "Malware payload (Mirai)", "value": "ba7c5e4484a1c11f3ecca97a7da4190a7e3a6f80e18cc6563dccd318f6c0c6ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918293, "uuid": "067d4a79-2ea4-4fbd-b005-df308a0f2b30", "comment": "Malware payload (Mirai)", "value": "c8c2cd66303d8ecf3a42bbdeae56eca1906cfde4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918293, "uuid": "f03d00d3-0ca4-4f85-9598-802b58af63fb", "comment": "Malware payload (Mirai)", "value": "1cf69b2341648f6fb2fe40ad25e14dbacbe33ba6a598a3d6a360d8ffdec762ae3bc9297490b192bbb726cbab752425c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918293, "uuid": "36398cf9-93b1-47c5-9163-83c7c1f316cc", "value": "T11D330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918293, "uuid": "fc18e271-0c7d-44a3-903b-81bbc678da81", "value": "768:gduPBFnHooqR8qOCKq2cH4Y3e+TK806MMUVjzMfQXOtHud2oGG:r/hqaJM53eqK806MHdMfQXoHuCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918293, "uuid": "67ce829b-7aa6-48b2-9851-bb6437c9ca67", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918293, "uuid": "543a7971-aba1-47c9-b824-61cbabce219f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918293, "uuid": "0c5d125b-059a-4238-a5cf-2d3e2344dd7a", "value": "cdf6c5bcf3d15590ecd99fb50137c615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c3ca15-157a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687932749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932749, "uuid": "5fef89a0-a0ae-45e3-9a0d-76cb2a8ccb06", "comment": "Malware payload", "value": "980d5ec4e8b6d25880215f3235286d3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932749, "uuid": "8cc7a1e6-04ce-49fd-86cc-824afa6f7140", "comment": "Malware payload", "value": "baf51129adb572a2986d0c9e985692e6fc0520fb444ea7c6bbc882d33cd31d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932749, "uuid": "8304bf6f-cf97-4265-9803-1fe998663637", "comment": "Malware payload", "value": "5e6c9ba162ccce8432d7bd9245e1a26bc7559933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932749, "uuid": "b389b6a4-1468-42f4-87be-2437e794dd1e", "comment": "Malware payload", "value": "710f0bb308575845d2958f14905db5681c58897fbeef10587c9967b3c9afb0745cabd3e95416c542295b728fb9d27671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932749, "uuid": "fb438007-ab7f-4558-8898-b20df80c5112", "value": "T159752212BEC299B2E4622D335A355B11683DBD202FB5CEDF6794691DCA205C1FB307B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932749, "uuid": "863bcb9c-9982-4bc3-aa72-c98ade06641b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932749, "uuid": "1d1f4cb8-0361-43cf-9cf4-462407917577", "value": "24576:2TbBv5rUyXVXcJApapb36Ea6zjckIMyPADtuCfbf2EeB9Om/4ON15tJ3NHKPI3zF:IBJMKgpbiojIbKuCjfK9JbND3r3zNkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687932749, "uuid": "c602c81d-d7d5-4601-a93a-2cac637b2744", "value": 1584588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687932749, "uuid": "00f6a55a-f16c-4e5a-a70c-ef779b0d3a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932749, "uuid": "6ba0d971-d7f4-4ff1-b3e5-2f930311e8b0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f589f797-15ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687968912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968912, "uuid": "46cee948-8940-4198-84a7-611188beae53", "comment": "Malware payload", "value": "beafb777e977775be6e6779cb9d668fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968912, "uuid": "a38fc484-f193-46d4-b27f-1c53e994b8c9", "comment": "Malware payload", "value": "bbf825a26d40e100d179dbade591269215738f768c31d2bbfcb184aebbc03ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968912, "uuid": "41bcd9aa-e636-4781-ab7d-d4a4070e43cf", "comment": "Malware payload", "value": "de9648d9e0bbafdf17c9f5fdd1d1b98e84ec15b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968912, "uuid": "17538948-56d7-4831-86b4-76b0c679026f", "comment": "Malware payload", "value": "acef40cbfc1f105bfe2d924858ea5d26ca05df1e99170c95e8bcff7e58663dd5da874e299f82249dfa4daa5bf16c3815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968912, "uuid": "5663c5f6-e26d-4aad-848d-6edc36317b8e", "value": "T10A950756E7B610E5E5BAC138C552722AFC7178558334A7DB87909B4B1F32BE0AE3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968912, "uuid": "005d9609-84c4-4924-8e75-34c298ee33b3", "value": "412354c261bcc10006486f4fb124c4c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968912, "uuid": "4fde21da-f574-4a9a-a336-708c63a4bb16", "value": "24576:wuzXOSYF80hNFtiD4i5U+/UD4OVfLfSTWiAuLNztIjocSHK:wuqFRhs0ixUtzfSaiYsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687968912, "uuid": "cbd1a44d-f448-420d-a244-8a74252362d4", "value": 1932280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687968912, "uuid": "2beeef8c-5448-4217-9aa2-799e70f2ddee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968912, "uuid": "4c917d48-e5fb-47f2-b879-260088d15cdb", "value": "bbf825a26d40e100d179dbade591269215738f768c31d2bbfcb184aebbc03ece.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32eeb59-1601-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687990812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687990812, "uuid": "a53439b1-337b-4d87-bed4-e15d43b3bfe3", "comment": "Malware payload (RedLineStealer)", "value": "c131e076e6e168d473db1aad7a3c7013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687990812, "uuid": "d2e27219-46af-4ae6-b177-f54e5f03558f", "comment": "Malware payload (RedLineStealer)", "value": "bd0c77b00726e2049625bb5080d65f0fc2919703cada24ea549c7a34e5119ac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687990812, "uuid": "f7ac3f33-613e-40b2-919a-9a06616f4718", "comment": "Malware payload (RedLineStealer)", "value": "48c565c4704697cb5558e34844a4cd547d04d700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687990812, "uuid": "4df1b7bc-6b5a-4f04-a290-1dbaaa96beab", "comment": "Malware payload (RedLineStealer)", "value": "b531ffd5a0c1c0de3ccf84ec0e2b3db1c8bce7aefc54952e26b36c498f921886c10871e1149b0113daf4182ce00aacaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687990812, "uuid": "05e0ae24-222e-4b8c-b8bc-43392ff1b445", "value": "T194E3D524279F8930E6BB4D3D6CB15DC066BCEC12A942D74A4ECDF1593A73B80DB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687990812, "uuid": "a5c5601c-0d60-4c72-8268-fc4151198de9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687990812, "uuid": "e0f77de8-b8d1-4782-81d5-d827c273d984", "value": "3072:OV+m5cvQmRSNme8X0TiLAuVVHhJZR8e8h2:OjGh9ZHhJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687990812, "uuid": "0448c138-e9b8-4147-bb04-af4428ba0c68", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687990812, "uuid": "c6af34f2-2bcf-4f3c-bbc3-37338ef08755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687990812, "uuid": "7e90a092-04ea-4f6e-907b-f817a8d8eb73", "value": "c131e076e6e168d473db1aad7a3c7013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ecf8ce-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687987107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987107, "uuid": "d4281df9-eb3e-4d6b-b1a4-803a016ea601", "comment": "Malware payload", "value": "77cd0df06698de6c6bffe8400305085b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987107, "uuid": "5f364683-c87f-4675-99c6-75fec167dddd", "comment": "Malware payload", "value": "bd9dafd9a575b5cb77bae553a5277d335b84f0d2aca4d7f684b14baf98d3d3ae", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987107, "uuid": "acc3b262-d8e8-4c4b-a65b-80418c7d9679", "comment": "Malware payload", "value": "4a5d217c4a2d6c06731a41e12c18560bf7e52332", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987107, "uuid": "3e748655-2627-420f-b32a-4b5b9572f943", "comment": "Malware payload", "value": "f9b625142cd1cc8a5a9ae9644798f3cab49584666b3e694d677b3ba6a7833f791440c1674bc59c21f25e044b8747ffe0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987107, "uuid": "4969df16-1f62-4e5d-9b33-af0edc43cf08", "value": "T1B56191932151B8EA414283BF3D996AFB807FC224954A7044F78C4F59F9DDE633A8E6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987107, "uuid": "0a888077-7dbc-47b4-9bf1-a0b71d65400d", "value": "96:BqMGTFcJ/HuSf+FNgQfRJL0H1mAiBrVMr1WG:BqRuJcFoH1mAiBrVa1WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987107, "uuid": "da70101c-df97-46e6-aab3-4317785ed8d4", "value": 3255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987107, "uuid": "8cd3c1d3-8157-4dbf-97bd-c8ac13dca318", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987107, "uuid": "5515d612-f4ff-447c-890c-9c9b26f783f1", "value": "payld.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5593676d-157d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687933854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933854, "uuid": "4f050015-c5cf-48a1-9cd4-7d84b7a1ab59", "comment": "Malware payload (Formbook)", "value": "816da502dd93bba053d28ca41767c94b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933854, "uuid": "8c7a4861-4dbd-4d7b-b130-0f8e34c1800a", "comment": "Malware payload (Formbook)", "value": "be3324f0d5a2da5608acf864ed8eb35df95081915d10d8f8a81c302747dc7710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933854, "uuid": "61fbe218-d7de-40ca-b5ae-35587d538f4e", "comment": "Malware payload (Formbook)", "value": "91d82213d96f6f09922f397f2689b51b2471b7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933854, "uuid": "b1964817-34f0-47e1-81ad-a0c2acbf39b3", "comment": "Malware payload (Formbook)", "value": "b56cb2a5889e11a9f1c63068f88e07e46d4ffdeab62fb39a4a9f01252927f3a62bd35227bdbe919faebb8fb6d2805cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933854, "uuid": "d16b4015-97d8-4683-8e66-2756fad40bb7", "value": "T183D22A1A75BC4233D9AE03BD19B286901B73FB77A316E35C19CF79EA35222B01614763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933854, "uuid": "68a452a4-121d-49b3-be8d-73535adaed4c", "value": "768:Nt5dnpmraeMGOToX6h98hMIA1mAojF73d8iUBtYA:rduacOl6SmXatYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933854, "uuid": "df9c48ff-7b69-4adc-a485-cf1ce93441df", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933854, "uuid": "2804d2e9-5295-4cb1-9029-d82786f36844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933854, "uuid": "6c99381d-54f9-4c81-bef5-aca820b82c20", "value": "SecuriteInfo.com.Win64.PWSX-gen.14476.13319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3989f34-1557-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687917691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917691, "uuid": "32ce51bc-1105-4f7d-a543-e5a8ec04d43f", "comment": "Malware payload (CoinMiner)", "value": "9cde4e6c936fd8f4040755ba8c623f11", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917691, "uuid": "57ecee1d-6242-41a4-ac0f-904593d4069c", "comment": "Malware payload (CoinMiner)", "value": "befe0e0f7794555fe00580395c4dd6437ea0466844cc24463fad8e89dc6e75a9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917691, "uuid": "a7c7055a-3191-452b-8fb5-ac8f273abdad", "comment": "Malware payload (CoinMiner)", "value": "1b0a9c44d32af8edade3bff3726c4ebb91ec4fce", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917691, "uuid": "ec0228e8-7e52-4c97-8b14-9309da9ca835", "comment": "Malware payload (CoinMiner)", "value": "fde2c28d56ecbbab455229436615671a51efb8b5d9d618cd93b06af00046c9589ec33d47f93b83dc856339a3c5ef1724", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917691, "uuid": "dc6382df-8414-457b-8a6e-51644782b81c", "value": "T122643A3392F17C54E9254B72DE2EC6E87F5EF6538F2937A622189A6F05B00B1C273650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917691, "uuid": "75349c60-d624-40fa-aeed-e3c526799122", "value": "ddcdb1c08a1de8d683d90430b0a24222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917691, "uuid": "4a3c2604-3447-4255-a499-c1599c0acf75", "value": "6144:7YvSl7+mup08ibcVmga637SmGqrSjsvLWn:7YvW+muzAcHa63DGmDWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687917691, "uuid": "5f77b4bc-bcd7-439d-beb3-381556a0b792", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687917691, "uuid": "588d127d-ae44-4eb7-a928-dc447326d6e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917691, "uuid": "0086dbc9-fe04-40f4-bb09-fe6f8ab105ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2c526e-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962777, "uuid": "512b6e51-e759-417d-89fc-1babe1b37df8", "comment": "Malware payload", "value": "799c6629928f0b945662d787d85a60e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962777, "uuid": "5de9fe5b-6f10-4cd2-9900-9349f451c3c7", "comment": "Malware payload", "value": "bf7c9b2af58aff0d7ee0c677ae8fdc106452f3a7eae437cc47dcb0ae36a9134b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962777, "uuid": "cfb42d2e-5a04-42d6-abd3-3dc9044a264c", "comment": "Malware payload", "value": "357ea36c557a9f397c3ef49084b83795c28c272c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962777, "uuid": "2bac9dd0-2d91-45ed-b9c8-399df7be8691", "comment": "Malware payload", "value": "7e99bf7932b63ddb65d887e99db9457025f3a109fe612594a28c8f2f7641635d202b3e431384cbc2afbd336f299d4d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962777, "uuid": "20e943b0-90ba-4be5-94c8-ea08192e7548", "value": "T1A4D523507614CDE2C88E26314C4B5EFA27B17B526D368F87F36DB32E1E727C06522296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962777, "uuid": "8fb1db90-8d85-4c4c-a305-39dfa6746aa1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962777, "uuid": "788725cc-c01a-4024-bcb0-1f55e7e3352d", "value": "49152:hkX17LLS6pLnlbv0l8jcsD0fFav+VPGHXsh6b95hBky5T3Pw7R4HL77:hSRWglb+8jcUV+VwX4e9nB15z0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962777, "uuid": "f0373db4-b874-4093-87a1-3f9179ae3117", "value": 2856448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962777, "uuid": "984916b5-a799-47ab-a55d-1d4f4048d64d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962777, "uuid": "a893e4ab-d6e7-4e5a-80f2-aabbfdfc18bd", "value": "799c6629928f0b945662d787d85a60e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff3fc59-1558-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918222, "uuid": "737d9840-9493-493a-b69a-54c99eed4806", "comment": "Malware payload (Mirai)", "value": "249a29515fb2d6d3d7a38ec4add32157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918222, "uuid": "f1ee6d80-94dd-426e-8ce8-8fec27f354fa", "comment": "Malware payload (Mirai)", "value": "c09f275d3707ba0a3ca5075e18a9a732c9067b8d36f48dc393caa25b34185c7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918222, "uuid": "3169f386-bac0-41a1-bc2f-15908518877f", "comment": "Malware payload (Mirai)", "value": "c134e29febd75dedc21a85c5206a98c201f0e6e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918222, "uuid": "14f448f4-4942-4f69-b089-e977d9b3ad3f", "comment": "Malware payload (Mirai)", "value": "3d8c3a566a2ffc6404827e5f8b56cace7bdf2e221b787c7d52183d714db9480c2b4e608c57ee0d3ecb1bf108c08eb40e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918222, "uuid": "0cc71db3-5800-4066-ba2b-5f41488d846b", "value": "T184A2D025D345AFF4DFEF9C9452C2C2C2B6E543C62786C8E340EEBF016506046B788C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918222, "uuid": "5cbd1af2-ab8d-4a4e-a48b-7930f51f6187", "value": "384:7/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5FM4uVcqgw05VxJv:7RxsSVsMD6xiJJE5zRWN04uVcqgw09h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918222, "uuid": "313f9bdb-3cc6-442a-bf0d-0fd684b73a35", "value": 21892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918222, "uuid": "b1068222-b1d9-4135-9a7c-e03656678ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918222, "uuid": "e7ace49b-45ba-4402-aab0-9792b281de71", "value": "249a29515fb2d6d3d7a38ec4add32157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50ab2b1-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687963301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963301, "uuid": "9a76ffdb-0ce3-486a-8653-1c6525765024", "comment": "Malware payload (Fabookie)", "value": "54583393f5b39d6f0765d4a54e372e0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963301, "uuid": "948d3e34-a617-482a-b693-0243ba733caa", "comment": "Malware payload (Fabookie)", "value": "c15796facdf9378bda2c0a972f8650e58cd3e35e582548c18bc70d046a55d520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963301, "uuid": "b57bff79-68e8-4e71-a026-4d97b78145fa", "comment": "Malware payload (Fabookie)", "value": "8ac1471f6c4fb033d25ca7328f44ed85b15e296d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963301, "uuid": "736860b3-46c4-47fc-baf8-5c3a24b5ded5", "comment": "Malware payload (Fabookie)", "value": "37408a96471880f420b8e5a7f7055659f65edfea184310fe1a200e6fc4b5783e7035d79e4ac445fe428d914f89925d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963301, "uuid": "af864840-24d1-4a33-9b20-e8998e94a5b5", "value": "T173643C156FB91CB6C017B43F0C6E84524B337827166783F7A496DEAC0EF76E8D466822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963301, "uuid": "bd29b328-beba-41d2-8699-b01fdd8aeb49", "value": "a7a19cad0c2c193feb43fc00c1b6b502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963301, "uuid": "cd7afa7f-9807-4964-8db6-38ceb5d2e4e1", "value": "3072:E8kUTMYQ0qIN6NtVcOXVK5UMJ2LUPj38eyRS6CSfKVu1xgCAWU8fvJqxEm4x1ES1:DMnt3VPCJPjUp/1fvoxEvTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963301, "uuid": "e415b9de-d193-4e63-be4a-7a6669188f29", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963301, "uuid": "fae337c4-910e-464d-bb67-e6d73ffff68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963301, "uuid": "695d95ae-2b86-4ca7-9526-500893e3f5a3", "value": "54583393f5b39d6f0765d4a54e372e0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955493d0-1586-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687937827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937827, "uuid": "acf27bf4-93f1-49d2-9903-54cc9be6b570", "comment": "Malware payload (AgentTesla)", "value": "2fba125e55b4145326e15962775e8c33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937827, "uuid": "eec221ca-796f-4bb3-8b8d-3a389c01bfe9", "comment": "Malware payload (AgentTesla)", "value": "c5a6df42235a175be31fec2a8eae40ba6263d48a207debbe1c4cde98861182c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937827, "uuid": "68ed2081-e7d7-42bc-bcd9-c52169fac814", "comment": "Malware payload (AgentTesla)", "value": "7eb926aec6bf42e00a2a68c148e185d2f3de86e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937827, "uuid": "7f47d5f6-bf8f-49b6-9c2d-928a2d8abe3a", "comment": "Malware payload (AgentTesla)", "value": "847f0ee2e2deb4265d06a6ef062db10c8dee54a5e0302f0e7bd3661136565b651c817e30739e4760032e2ad8ecb91abc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937827, "uuid": "bab847fe-b285-4234-a64a-a4247ead9507", "value": "T1203517AC361075DFC8ABCE76CA942C60EA6074A6570FE203A01715ED9A1DB97DF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937827, "uuid": "78b51f83-0a68-47ca-ba0a-5183f7545986", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937827, "uuid": "9cc5b750-1897-4f46-bca3-81153c97ffd4", "value": "12288:Tg0hXCPJcPDxqVPVcKNJycqM0bQOksecpF24/rUYECb0ndeE8FVACkd3/ENs5oY1:5vSPByJMzW24/gzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687937827, "uuid": "51516f70-39b7-4615-9ef9-0475a77c90d2", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687937827, "uuid": "39636d97-83d5-4498-99b4-ecb6bb9d2246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937827, "uuid": "eb2240fd-e42a-41b9-8f04-1fbad373a4ff", "value": "DOCUMENT-34789208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e69ea75-1557-11ee-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1687917629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917629, "uuid": "08567074-2308-4390-8b9e-d869efa5e77e", "comment": "Malware payload (TeamBot)", "value": "575d393b71e0ca5d07054f16e87d8a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917629, "uuid": "56f2f136-7070-4560-910f-c3551512a43f", "comment": "Malware payload (TeamBot)", "value": "c62d6a8f03122f152f75051babb0a9ad178223ae33a2205caf5675f29cf3cef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917629, "uuid": "5399f3f3-c447-4769-93c4-3808dc32a828", "comment": "Malware payload (TeamBot)", "value": "36d0b679651db7eaf7cd02c61fa7377c1e6ac794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917629, "uuid": "f57f03bc-c6b9-4824-8ecc-172313bb1505", "comment": "Malware payload (TeamBot)", "value": "f868129e97a9036ab9c4ac194b712b7bb93f286430a8299764e3e591d41420cc4d97c264fbe4cd0f8779607b7431e69f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917629, "uuid": "ba4708af-0956-4f41-985c-9413ffd6ae67", "value": "T1D1F40212A2F17C61E5225B729E2FC6EC361FFB50CE5E3766221C6A6F09B01E1C672750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917629, "uuid": "c7367a59-d950-4906-ad87-b3d356856030", "value": "6697fa255a05fffbb8331cc121287cb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917629, "uuid": "d72cee42-9d93-4bcb-b7f8-2233993803dc", "value": "12288:vz9yd/vcS0e6SliioCA2cfPjHKj+39qMurUGsZqLmmtlqmV26oU5UcgVij/Xun:vzoBVNiJjHK62iZ0LlqEYc6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687917629, "uuid": "bc79d1b5-d711-4aeb-a4d4-500361c5a70e", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687917629, "uuid": "eaae9468-79fb-4f77-886d-91d95ad0c70e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917629, "uuid": "c1c2ded9-094c-4e6b-a745-06c48433b4cc", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b656dc-15c5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687964771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964771, "uuid": "07f73f25-c10a-4296-8019-6222afa3361a", "comment": "Malware payload (Amadey)", "value": "0e920697f02451a346d4b68164c630e1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964771, "uuid": "f78a4efe-afd5-48c6-b39f-9a21ff440df6", "comment": "Malware payload (Amadey)", "value": "c79d5c1b10a3c1959755ab98a2c097c00544e6f42e108df002f48cf2d9d9baa8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964771, "uuid": "cb6718e8-cd11-4fbb-ac02-11df94ce2e17", "comment": "Malware payload (Amadey)", "value": "8dbde48176b60305aad6db2a0b3a180223d9f538", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964771, "uuid": "5383d390-ca11-4946-b704-3ed8d6fc310c", "comment": "Malware payload (Amadey)", "value": "437f616adf386927725ee21063a7e2d178a24696a3ce8963cac07d36f31cf6f9da8e48fef6c9deb30150bfdabfa2d132", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964771, "uuid": "f0db2a91-ee50-4e28-9d5d-e34934adea63", "value": "T1DF655A313F879027CA610072F73CDA5A3678AF621B6384CF9BE479BD44B18C15379A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964771, "uuid": "8b3acbd5-e906-4878-967a-ae294f419a9f", "value": "e91a73dafe4345072bd74b1c734e5f37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964771, "uuid": "deba6a48-c930-4141-b01e-d43e12b46dbc", "value": "24576:EhZDSdKu3HdjN4STH/EFaeN5CJ7FR5fuudV3+nLyo85f4Qy:EhZGd/jN4STH/UfCJBR5mudV3+nLyo8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687964771, "uuid": "efa0a51f-f672-4121-8049-97d32185f0f3", "value": 1466680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687964771, "uuid": "c0360ed7-b719-47e3-bda3-f65199731db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964771, "uuid": "2920b81a-3b95-47c5-bf66-3eff51095641", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5f5afc-158e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687941031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687941031, "uuid": "5a38ab8b-8b5e-4cb1-a7a9-13fdbe51cced", "comment": "Malware payload (Formbook)", "value": "25a6280b20b14dc747c700a1a91cb51b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687941031, "uuid": "245e0954-af28-412e-9ce2-803812b8fcd1", "comment": "Malware payload (Formbook)", "value": "c81c9ba400d187e3f9ddbc3c9b31a5ac9ae2d102969a30d0896b19efd1981ceb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687941031, "uuid": "61f04ac0-ec85-4abe-86a4-222645cfd70a", "comment": "Malware payload (Formbook)", "value": "d6afd68cca616d505ac13532c008c328f225947d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687941031, "uuid": "0f199dda-1510-4e48-9c5c-2a505ae57c93", "comment": "Malware payload (Formbook)", "value": "4665176938a8246958ed32d4e490d8828b25f3a4bd2c37282e5a18be08bfdd1c4c5b8a0d95920de523b7cebda13c47e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687941031, "uuid": "a78e5f1f-2294-4b66-afed-0d846462be19", "value": "T1FDC4120B75E9275BC09917FF26E2718567B8677E6004FBCA4CC2B5C6C4DA7928180AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687941031, "uuid": "d37bec2a-d327-4062-a5fc-1cd27c5944b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687941031, "uuid": "1da14ed1-a474-49cf-bc15-8691520ed361", "value": "12288:JPComBcpx1XTaASnOXo3aqhgXMQhbqCEPUwfqzbXKxySLJpcnZlmYH7J:4omB6RNhRqC3RHqDcnZ3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687941031, "uuid": "524f971b-cc40-49ed-b5b3-9ec4fdbe1acf", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687941031, "uuid": "2e192709-d155-4c16-9d68-e06413c68128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687941031, "uuid": "c1b7db00-660a-456b-9c7c-61c90d44eedb", "value": "25a6280b20b14dc747c700a1a91cb51b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30fe164-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687933232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933232, "uuid": "1f2bb26a-67a4-44c3-85d3-b166869f43d7", "comment": "Malware payload", "value": "b8984fa531de29bff678fa99589dd2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933232, "uuid": "1f2fd32c-4cfc-444c-9912-7f0aae15fc25", "comment": "Malware payload", "value": "c9daa467a96f84c12457a5d112cf5e3e6afa80b08a2215e0886d1fc964fb5762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933232, "uuid": "2128acc2-e806-4c89-bf84-b6a7981e90ee", "comment": "Malware payload", "value": "ac1f0c5a1d0a77a12f8ea0ff99d48726b8a69006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933232, "uuid": "15569c92-5135-4daf-93b1-6d5b56fe001f", "comment": "Malware payload", "value": "382d6c5ba81d61a9e45da702a01dceb3e338ec42e0a6dcd3e6d8cd88db21971c4528e51979561f1dceb63451774615b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933232, "uuid": "cbd86d49-207c-44c1-98cf-25f769c10874", "value": "T18A256C4973A4419DFEA7E1B6C623C607D7B178460277862F02E49B766F337712A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933232, "uuid": "39d5109d-d446-4a7b-be76-02237a59ce1a", "value": "fcc64241b6c54450be7b9c57ec0906c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933232, "uuid": "fb64541e-19f2-4d4c-a26d-2e022dc82192", "value": "24576:BmJZW2wSdIHuiCyhuGaD0y13DrmmfVpd+c2ZAa7ZRaLt:BmJZW2FIOiCIuGaD0yh/zvd+c2ZAafaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933232, "uuid": "175c2693-a92c-479c-9bb1-d28261210e57", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933232, "uuid": "27916b9e-ad77-4219-a697-8a574396a94c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933232, "uuid": "f7f976f1-64ee-4209-8375-ec6701b7dcad", "value": "b8984fa531de29bff678fa99589dd2c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afccdaa-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687962720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962720, "uuid": "5d5ad3fe-cf3d-49c0-ac2c-08db8ff48270", "comment": "Malware payload (SnakeKeylogger)", "value": "28950d733a57f8b60d6c82be7c105d5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962720, "uuid": "a849c205-7121-4502-b8bb-8c1867e4a395", "comment": "Malware payload (SnakeKeylogger)", "value": "cae1354a45569f45b407e95f00ba53ada314874b706f903f91960464c7f5ecea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962720, "uuid": "29e450ea-e1c8-4f65-9ed1-d0652ace0fcb", "comment": "Malware payload (SnakeKeylogger)", "value": "97215f12304287305f5d72bcc1cff6ea67a5388c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962720, "uuid": "91f39dba-e5b6-477a-955f-81235f5fd5c6", "comment": "Malware payload (SnakeKeylogger)", "value": "84b3b750f30144e357e8906bc2ed1b7f971fcb32730182bebbb2babc81e3c38038d71eab350577d3e58ea91eb0978d17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962720, "uuid": "e05cf894-0893-4476-961a-ce86ceba70c8", "value": "T157D47B3D2CBD6A77C034D6B98FE5A463F59CC43B3A22A93254C787544346EA225D323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962720, "uuid": "4661ffb8-598b-4def-b278-f564650e82b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962720, "uuid": "9520485a-253a-4883-b93a-e1be5810bcf4", "value": "12288:gCXWldJ25/+cNSXq/LpXt3tmiDWkEuZlZ:g25/+cNSXqjpXt9a/ufZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962720, "uuid": "b1e1e768-2e7d-4d8c-a10a-89c9a499504c", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962720, "uuid": "0b9baac0-3986-4450-9a6c-3ab654ea1a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962720, "uuid": "f127bf20-f7fe-4934-83b8-f65b828064d3", "value": "23-010-04354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c0eaea-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687961961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961961, "uuid": "158891e0-6bd3-4c9e-9052-4c7940b74b40", "comment": "Malware payload (AsyncRAT)", "value": "0c160b0c2ee4b192f4d9cf0202b57a43", "object_relation": "md5", "Tag": [ { "name": "0c160b0c2ee4b192f4d9cf0202b57a43", "colour": "#5F5B33", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961961, "uuid": "fe677ac5-8964-4a1a-aea3-44722347d632", "comment": "Malware payload (AsyncRAT)", "value": "cb9bb8d4b50cb8090ecf8af646e8b691a9c8cdd3dc0b40a217af4b84e08f7563", "object_relation": "sha256", "Tag": [ { "name": "0c160b0c2ee4b192f4d9cf0202b57a43", "colour": "#5F5B33", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961961, "uuid": "d66d1f92-0bb0-412e-9d19-18f074067d03", "comment": "Malware payload (AsyncRAT)", "value": "38a0d1a51d097d550646ad8744a86607f4356ca3", "object_relation": "sha1", "Tag": [ { "name": "0c160b0c2ee4b192f4d9cf0202b57a43", "colour": "#5F5B33", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961961, "uuid": "9144b71f-ddf4-4283-bcc7-655a8c75b7a0", "comment": "Malware payload (AsyncRAT)", "value": "5fe8f1ca64b05a6379df678c676209ee14541c598335bc6062896e27680e61172bc60d28fb0dfc7d738046adcded139b", "object_relation": "sha3-384", "Tag": [ { "name": "0c160b0c2ee4b192f4d9cf0202b57a43", "colour": "#5F5B33", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961961, "uuid": "d395574e-0cc4-4a1c-87c7-e5501cea4c26", "value": "T1AE84D0044F54EDC1E3AFA138D8F1956C93B0926A918ADFF26B9884B26ED374077146CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961961, "uuid": "8cb89811-a511-4ff4-a890-1e5c0848f689", "value": "6144:JQ2u/5x+mYnfDp2mHRUm4r5uEj+1Jh5iCQy3TKT7vFH5riCrJQZ0kgpbUF:JQ2u/Wf12mxUm4r5uA+1Jh5iCJTKT7vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961961, "uuid": "9d801a52-21dc-4b52-8ba2-26486cab2208", "value": 371216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961961, "uuid": "0ee58a61-7e8f-4515-b38b-dc98cd270a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961961, "uuid": "96476be2-8ad7-4a7e-8008-219dc8d7786a", "value": "0c160b0c2ee4b192f4d9cf0202b57a43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eee0cd-1586-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687937819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937819, "uuid": "0be17ba9-52c7-4f52-b83a-e7522ff3e229", "comment": "Malware payload (AgentTesla)", "value": "350bbcbb253f740f1d83d4d77e35be91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937819, "uuid": "b065bde6-bc6b-45d5-9793-9312c0671592", "comment": "Malware payload (AgentTesla)", "value": "ccb72e19b00ec30028d6c2784e65f439dad5805e673fcc34ad1e12eba0ffd1fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937819, "uuid": "2dd290a2-3cdc-4407-ad6a-fe9329daff3d", "comment": "Malware payload (AgentTesla)", "value": "5633d352d015f41b6c74e6d63050c463aedc4e59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687937819, "uuid": "b9390009-8333-43c3-856b-7a0fea434a4b", "comment": "Malware payload (AgentTesla)", "value": "8d1cbcc00a29ba0db0edd6684add72b3a7a69e043b47b4a606173556302d19cef20f3340e69fad4ad926470ea16a58fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937819, "uuid": "1f1a8046-f193-487b-8be3-db7bd1c97622", "value": "T17EF4238B2DEE35350B8A64F72B3E13D20E11A511CBBC3496377DAE7DAB2F414465E640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937819, "uuid": "18a49417-84fb-4c1c-9f55-ec46ff356167", "value": "12288:0NCK/+UYT1X8wA2VyX1V6KDXy+s+cpy0oX6EZR79QiEbRSRIMRDM9:I1+UYBjnVG1XyI0676isRSRIMR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687937819, "uuid": "8a876c00-b29a-4974-b569-74506fa86a76", "value": 734682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687937819, "uuid": "b309f796-8cba-43fa-b602-f242b18e4096", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687937819, "uuid": "54d86966-4479-4d4b-b934-9847e9793cb8", "value": "DOCUMENT-34789208.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c47de9-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687935676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935676, "uuid": "81e19e6c-93fe-4a5d-a58a-12098aeb6818", "comment": "Malware payload (AgentTesla)", "value": "c4df006e39809b6857f3cc9117fa2088", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935676, "uuid": "34a2f6eb-53e1-478c-b711-02ee14f4d86c", "comment": "Malware payload (AgentTesla)", "value": "ccc2705cc016a910af89b39b5beeca2885eedd714cca5ab153b416c201d0ea96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935676, "uuid": "b955a0c5-dfbe-4267-beb4-f5435f06436d", "comment": "Malware payload (AgentTesla)", "value": "cd5ae28a1037aa467b507f533a3361383a954cf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935676, "uuid": "c16d7460-6ddd-4a41-987e-290e264074c8", "comment": "Malware payload (AgentTesla)", "value": "f7696de7f2a3251fe9de52c28511b7af6d897857e3a2c8cb8140a35013543e2e488558356ba576a6882d68f8f06939f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935676, "uuid": "d83d23b7-14e9-4f20-a177-a69693c12dac", "value": "T10EF42838287D0B62D178C7F98ED18053F3A4953F3829EA295CC267DA1A56F9215C363F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935676, "uuid": "6a83ba49-6610-4506-89b7-a5c5f4266112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935676, "uuid": "64d9dbe1-a950-4001-984c-08cb1db35beb", "value": "12288:PNnGCF9QcI5Szby9RkQEt1LgYaHxFBF4EllnGFveYp3wvmcC:PFGCocNwRkXMrBiylGFvervs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935676, "uuid": "54e30b5b-77e2-49d0-b454-10c1819659ec", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935676, "uuid": "3e366173-8f89-4986-ad54-408590b2496c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935676, "uuid": "944c7d32-91e4-4029-90d2-6c29ca73972e", "value": "c4df006e39809b6857f3cc9117fa2088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4c9764-15bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArrowRAT)", "timestamp": 1687962132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962132, "uuid": "4b319177-8079-452a-9a0b-cc73302fef83", "comment": "Malware payload (ArrowRAT)", "value": "288a04f04d9fc3e84ff5b2402c8050b1", "object_relation": "md5", "Tag": [ { "name": "ArrowRAT", "colour": "#DE0E56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962132, "uuid": "3d1c0076-8d7b-4525-aa8b-03a237b04a3b", "comment": "Malware payload (ArrowRAT)", "value": "cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6", "object_relation": "sha256", "Tag": [ { "name": "ArrowRAT", "colour": "#DE0E56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962132, "uuid": "cd11d9a8-3145-4af2-a4a8-9dcb433698e2", "comment": "Malware payload (ArrowRAT)", "value": "8e0b920bb33920e298ac9f73ab4b7ea0bbdfdbf2", "object_relation": "sha1", "Tag": [ { "name": "ArrowRAT", "colour": "#DE0E56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962132, "uuid": "9bebc19c-1755-444f-bfb0-41a62da8a08e", "comment": "Malware payload (ArrowRAT)", "value": "f854930663ab71c8881bd31e06763d2644e380273d00c488b8aaee412f4d3f315ae00fb32d77282f16fdecc511e36539", "object_relation": "sha3-384", "Tag": [ { "name": "ArrowRAT", "colour": "#DE0E56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962132, "uuid": "f2d03aea-9212-4b59-8d36-921e16d04517", "value": "T188A4F17CEB85EFD1D2D8943841B2EB3E4A3185FB6516DB7A768488B06ED3340071A64F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962132, "uuid": "33ab396f-675f-444f-9444-6b03a212fd9f", "value": "12288:QkoPbgRuF1R5u7w1eTe5XxLvZNOujzAKv546Q4dPHm:QkEb4E5u7w8Te5XxLhN9l54r4dHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962132, "uuid": "755d5b2b-8f62-437a-a9b5-ea79ae49775d", "value": 468496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962132, "uuid": "8cc2b10c-bc8d-4195-854d-549fcc96b21b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962132, "uuid": "6ebc1307-46ef-4de2-8cf9-03f5999b5f6c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c23380-1558-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918238, "uuid": "891a7893-c927-4a8e-8a3e-c7797dbc9a9b", "comment": "Malware payload (Mirai)", "value": "3781e0c9e2198d5f1e01d488b9dd7a7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918238, "uuid": "4878f8ba-903f-4de1-be0b-16c3027230dd", "comment": "Malware payload (Mirai)", "value": "cdb80113cf24d2f473bca6fe821dc5839614be6cd1d05861e1bbfe862ea77ea6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918238, "uuid": "46b39d28-f465-475f-bebd-dc233a8e7a28", "comment": "Malware payload (Mirai)", "value": "9d347090e16a8625f81ce88b4a296395043ba8b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918238, "uuid": "997d0134-3d7b-495f-b8f9-eaeede2c3876", "comment": "Malware payload (Mirai)", "value": "0bec5326655ddf93cdd1301fd7f675cabaea4df35a25b13551ef69e16d5cc64acec00609f791fec5c0e7dc56feee5bcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918238, "uuid": "f5dbeb62-f286-49b0-992d-8caa8c599da4", "value": "T11B82D030619B74F9CBE10031EEAECEC6971A0BF8D1FC32D216596B78894210651F93DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918238, "uuid": "6f7af0dc-e7ee-44e9-9682-01ce1d0b1f56", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaO2D8hymdGUop5h5lw:2dV0P6+kom0tVAoNvm+to1O68s3UoznG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918238, "uuid": "a9001f4f-1ea4-4cca-9c04-62cc63c46eaf", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918238, "uuid": "0973ffc9-89b7-48cf-b43b-dff530189467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918238, "uuid": "76624967-cc34-4b1b-a223-d6aeeca5314f", "value": "3781e0c9e2198d5f1e01d488b9dd7a7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5263abe2-15b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687959189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959189, "uuid": "57e8643e-6bdb-474e-a7ec-a021de1eac85", "comment": "Malware payload (AgentTesla)", "value": "8166e9ea5b1355f90d16b1b377e96f8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959189, "uuid": "ffa6b1c0-258b-4121-9da9-d932d4a7a888", "comment": "Malware payload (AgentTesla)", "value": "cecc5b23bd44cfa9b41ff4d49f6070c248882c7c42c2ab4f6f21edc30160ad99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959189, "uuid": "c714f2ae-80e9-4070-b588-3741b1941e0b", "comment": "Malware payload (AgentTesla)", "value": "5cdc96fab43fdc1cfa1a4b17cfa5c1c201ea8078", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687959189, "uuid": "9058bbdd-e616-46a0-982a-29dc0ebe9b56", "comment": "Malware payload (AgentTesla)", "value": "996bccd03449c1eed8ab10c7c3d19294eba3d4e77093ce6f2a1f9d622b76b52d22833fe79682b2fe7a1bab432933bd4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959189, "uuid": "1eb3b4dc-64b9-469d-a086-fb8d5f184c3e", "value": "T1BD824CA9E78F01A58F50A77A431B4A89467CB62FF20540B274AC833533FDD2E45A59BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959189, "uuid": "0e766aaf-82fa-4615-a67d-1c7f63b15c70", "value": "384:/KiN1Dh6kmsRGD0X3hgnS6+v1nv0TRJOQWznPVp37Gh3msQFS49jEUwXy6hr8g74:b1F6kmzD0Xx11mcrnXaBmseS49jzwCYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687959189, "uuid": "e145ebb8-7371-4379-9d2c-5517c75c06dd", "value": 18271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687959189, "uuid": "752066bf-11e2-4848-b18d-713a98e84478", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687959189, "uuid": "987f50f7-fe64-4082-886b-8ff6ff262a4a", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.27231.3155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95046065-15f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687984212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984212, "uuid": "3aa86122-460a-4119-8916-a881db93c8c7", "comment": "Malware payload (RedLineStealer)", "value": "51b7849db58928fb6c1f1e2a343cd2f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984212, "uuid": "a69d0b69-62e4-4a47-a53c-c7ad4114cbd4", "comment": "Malware payload (RedLineStealer)", "value": "cf4a0d62d7bd3c46708d938cc52e6d0b31c03d53f771a8bba1b7210452aabc69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984212, "uuid": "fae52e60-46e4-4f28-b1e7-4eaf0acc6182", "comment": "Malware payload (RedLineStealer)", "value": "9dfc343901139a7faff5d1591dee8983b24e581b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984212, "uuid": "7528e0aa-681b-4c6d-bb4a-64c647adc96f", "comment": "Malware payload (RedLineStealer)", "value": "f0e7ec8751a837587176ce6cea56abeb1491b8dd7d3d149c9b5d9b33bbdc2d8755ea7ef2690377c48ffed9f86da7876d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984212, "uuid": "b3bb156e-89eb-4d58-8f88-9d170c9d4cf9", "value": "T14304D558324BA5BEC96F887D9C700CE0667CAC671246AB078D8EF0E43D3A7919F451F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984212, "uuid": "2c1c2434-032f-48a1-bea7-5e58cb122b4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984212, "uuid": "11981c3c-1e73-4419-a784-e9ca26c44e29", "value": "1536:Q7vfTJ36sv0W7T4/cOkrHMeowBep7jbZUxNdPYQ3Hbux6JLjSArnry0GkRo8e8hu:arn41erqnZUxNqCd1jSArn+r8e8hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687984212, "uuid": "3156adb7-dbb7-435e-8bc0-07a65563adaf", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687984212, "uuid": "c4134dee-417f-4fa0-8315-58526c05b458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984212, "uuid": "ff1ac8e8-6f9b-49d7-a00d-34d00512ba4b", "value": "51b7849db58928fb6c1f1e2a343cd2f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65002a2-155f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687921158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687921158, "uuid": "8bd95120-f503-4300-a1f6-19d72a917491", "comment": "Malware payload (AgentTesla)", "value": "5f62b3558fcff678c7e3af65eea16c5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687921158, "uuid": "321fab7b-7468-4f60-b4e9-cd632b87cd2e", "comment": "Malware payload (AgentTesla)", "value": "cf9f090b481fb79f8a0c70ce97767addfa855753be1637f0db6589bc978f7bfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687921158, "uuid": "a8d42332-646e-441d-939b-357ac4a51d48", "comment": "Malware payload (AgentTesla)", "value": "b6033c89b8d65311cfdf49ee01118a6b9b2b1257", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687921158, "uuid": "5830aec9-0456-49f6-9003-f8b85eebf536", "comment": "Malware payload (AgentTesla)", "value": "d470a042c806bdb98d0d17a95c7bfb2207888c89a34b4cdd6024b26d6438d3138f519cbd79a242452bd096508c4995f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687921158, "uuid": "eecb8f0d-d4b7-452e-9f0e-102abdd17ece", "value": "T15FD2925AE79B02B94F811276631E0BC9AB3DB13EB35144B1346C937423E9C294676AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687921158, "uuid": "da1b1e24-fb0b-4518-9655-037a71626a41", "value": "768:/Fx0XaIsnPRIa4fwJM1CAcv5PEttFbyVQ6RhKM0:/f0Xvx3EMczh2UrKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687921158, "uuid": "4cdb55f4-653d-4b17-a361-ebc1111b5e5f", "value": 30198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687921158, "uuid": "414fbad6-c02a-49cd-b87a-6d39316e4da9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687921158, "uuid": "e96f48ab-9abd-44bc-87fc-dc42618a5a6f", "value": "5f62b3558fcff678c7e3af65eea16c5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e30032-157e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687934249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934249, "uuid": "c9ad0c5d-6b6f-43e7-8682-a13a588df7b3", "comment": "Malware payload (AsyncRAT)", "value": "474db6698db5df10126a70ce08a3d0eb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934249, "uuid": "bc68b397-446b-424a-9129-992c9273eeb6", "comment": "Malware payload (AsyncRAT)", "value": "cfc2b79bd634d03d89b7a006176fe53ed5aa1e80790d21aa1d420b91b695d371", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934249, "uuid": "f75ba2bf-e96b-4cda-94b9-2d4c391159f0", "comment": "Malware payload (AsyncRAT)", "value": "e37c01ead0118c3e70313e067822c8cac4898a03", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934249, "uuid": "d5930dcb-090a-4617-8c9b-92f3db765526", "comment": "Malware payload (AsyncRAT)", "value": "dc0fa33ed2bcc08580d8a4bd83eda1a45548d99e3188d05b83642c74a228046f7ea09395b2c34d7e28403b756f18b45b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934249, "uuid": "d2487b78-8223-4e74-a561-77c97b4f65a6", "value": "T17204382437E81919E3FF9BB8F4B001259BB2F8236913E76F289459ED1D62344E550BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934249, "uuid": "06a76bd1-5c99-447f-ae17-95c1d7893d28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934249, "uuid": "de9030c0-1e3b-48f8-824f-e3cb0ad40171", "value": "3072:G+STW8djpN6izj8mZw+GSv5hqIPu/i9bcJ2cYvMO6+WpD:b8XN6W8mm+vvnXPSi9b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934249, "uuid": "1228d64d-855e-4d37-9833-8010f3dc5c58", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934249, "uuid": "129ad1c5-33b9-444a-9ca5-41d19299209f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934249, "uuid": "038f0a0e-6a9d-4fba-9d27-69df5fa5e480", "value": "474db6698db5df10126a70ce08a3d0eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327305b3-15f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687986194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986194, "uuid": "01ca98e6-c720-4458-b0f7-b99726f131a0", "comment": "Malware payload", "value": "4fb8e71b847d2546031f6a4a1b15451a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986194, "uuid": "c68a5c19-b165-402b-bd0a-b6d8f4703be3", "comment": "Malware payload", "value": "d08ff0cd9ca0176347f91fcb6ea53e3753ebac9a9936ae71a99c3a9d72973469", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986194, "uuid": "a6d7b52a-f18b-4478-843f-3867639c4c6f", "comment": "Malware payload", "value": "96c8dc1aebb436bd15066155a358ae4ac5641001", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986194, "uuid": "70c9dbf4-70b3-4524-b7e8-8a34807b566b", "comment": "Malware payload", "value": "40e3441e0386d1c24fb91659a083449ff49a07d58e574a2378da81f24866cb1e24f8158cab8eb7a43c508b71d4b41904", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986194, "uuid": "455f4dc0-0c65-4f85-98b7-4ffdb41dd302", "value": "T1883144013BE5503B4A0220B2854BFBD985D44A3FC3771C6970EEC6585F9505C933E39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986194, "uuid": "d1212104-2de7-47eb-85bd-d2bacf63be10", "value": "24:EGs0bgu+modQKPo8YdQsA7gFYsyHU7XEzLmtE7vyaUvEjLNdIlRY:EGVFoJ+dQ30yHV97vbUcnNalRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687986194, "uuid": "2ae8200e-8dd3-4f7a-8051-b92348dc6314", "value": 1462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687986194, "uuid": "cbc1f0d2-84d3-4a26-8e0d-a33764ca92b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986194, "uuid": "fd9220db-da35-46c1-9300-1253edd82061", "value": "r.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f171e587-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687963321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963321, "uuid": "03fa086c-08a6-4ff2-85bc-a00f84ce93a5", "comment": "Malware payload (ArkeiStealer)", "value": "ad302d8824a2e13a170604176ae1b571", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963321, "uuid": "2c61223b-799a-45e6-84d6-2cc0c22e798f", "comment": "Malware payload (ArkeiStealer)", "value": "d2349196b611e963c2099768c35e7b9de02436e1bccfe1b49d8311c41cd1ef55", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963321, "uuid": "c66704b8-649b-485d-bab2-c59ee44c953e", "comment": "Malware payload (ArkeiStealer)", "value": "e91e9169490b8cc0e74b7929dd0e8e66d28ef1ca", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963321, "uuid": "3663cc24-26d5-44ef-8101-a0d39742019e", "comment": "Malware payload (ArkeiStealer)", "value": "ab5a163d45d6064f84250774156b21257f988cf013a3e1be5c8a70e00f7db28ebdc5449ed62dbfd7db277e23cfa94ade", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963321, "uuid": "6cd1db77-5cda-43eb-820e-ecdf54312775", "value": "T1ED84B00362F1BC61E5164A319E2ECAE4761FFAA08F1D776B22185EAF09B01F1D273750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963321, "uuid": "1e5d6afd-e3c3-4263-9dd2-3a1084e9a43e", "value": "e452f645761244958e067c651397e7c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963321, "uuid": "728f04de-8b63-4406-929d-f796eae13d95", "value": "6144:boSslQizKDaL7Du9V7auzgNpdTSRwhZM3i+3U6DB1InEInXJR3:b8ltKDajuKuzKpNSR6+3dDB18nXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963321, "uuid": "dd96d095-b411-40fc-a74f-aa94212b7f7c", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963321, "uuid": "d55f96c2-7fce-4062-b82a-4f2199a3c587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963321, "uuid": "977d4c1b-27d3-46a9-afd7-3c2edf7f7c67", "value": "ad302d8824a2e13a170604176ae1b571.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264547a7-1594-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687943653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943653, "uuid": "82da83ae-39c8-41dd-bb4d-69aa3de6f26a", "comment": "Malware payload (AgentTesla)", "value": "ea314c635ee308ce6f1cfdb61d2c2155", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943653, "uuid": "462b697d-d2c1-44d3-aaa4-29b6eed0e770", "comment": "Malware payload (AgentTesla)", "value": "d33d37889922f0d394703588818c1ff0d31c930aae6a5c2b3057f12e1a00f9aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943653, "uuid": "81d3d33e-7e5e-4a29-a7ed-709020c640ee", "comment": "Malware payload (AgentTesla)", "value": "a2144010f78b1e7b3a2a67ca59d32af348d5c1a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687943653, "uuid": "06e95d64-fa1f-4544-810e-8456e97029a2", "comment": "Malware payload (AgentTesla)", "value": "7b216dd5babd8e92d3b6529f14c55c1bfbe6c71fb9c563f3fdbb01092c1e2218e455c2c2b37ef6bb96cbd19969660b1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943653, "uuid": "40e50e40-5df7-42c5-884d-daca95825d60", "value": "T106B423A17BB428BFF46A9D3C84E1D54F4418FECD2EE592869A27112163C3F524B25C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943653, "uuid": "4966e35f-5fa1-4dde-a060-240be419350a", "value": "12288:l1crhqRftrq9Bmf+iAa0sn0wNbKjATvjeMEI0fMkUGHSGd:l6rQtrqb0cs0qbKUTvqZfBUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687943653, "uuid": "6a758139-5bb2-460f-b073-f8a23206b889", "value": 527648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687943653, "uuid": "825a51c5-cccf-45b7-822d-a598c30d32d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687943653, "uuid": "b9c84504-0bc4-431b-9d4d-b585b8ffd4ee", "value": "proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce35e99f-15f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687984737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984737, "uuid": "59e6a419-729b-450e-b16d-db7dea1807d0", "comment": "Malware payload (RedLineStealer)", "value": "733e160d219a2d3287cd4c5cf2cced2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984737, "uuid": "af204a21-7076-4770-bc32-711851224040", "comment": "Malware payload (RedLineStealer)", "value": "d5a38499e773464e653c23eddf3b438b18d7a1db658584b9850581d6d8cbf68d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984737, "uuid": "b49cbee7-6002-4be4-92dd-76ce59bdb27f", "comment": "Malware payload (RedLineStealer)", "value": "69ff4773d86b42097a3fac766d3ec024df80f1a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687984737, "uuid": "935ea901-0022-48a9-8b11-348b680696ea", "comment": "Malware payload (RedLineStealer)", "value": "3fcbb8e96c81c33863d0c59e35c266fbc12fc26cd1e85ece5c5609bac7cbe06d44861a3b8371ec32c7d837d01b12ce05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984737, "uuid": "9f072a9a-977b-490f-8385-34ecc5c582c0", "value": "T181249F6322D6C0E1C0E69DFB2C5571A56A2DEEF1E7CFD34772C80E6B8D48745A4212A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984737, "uuid": "b570069c-580c-4977-b155-d91b59eb3111", "value": "9ef61842dd257cd165ffcf2d74517de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984737, "uuid": "6d9944df-eebb-44b4-baba-dde5048fa3f0", "value": "3072:sNfAqImUcDybvZpaN4PT9rcom/o1hxmbBLjr/DfMlnp1FUfKEd9dCw25vbxI:EfDImavClPkXUPdEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687984737, "uuid": "6caf8dd6-2ee5-4ea1-9c7a-b09e03e2b2ec", "value": 223880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687984737, "uuid": "287360b8-47de-4a56-9f45-a78f051b9cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687984737, "uuid": "c3c7bc9f-38e2-466a-b1ef-0e1c60e29ece", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccd1583-1567-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687924444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924444, "uuid": "1e31690e-a2b3-4186-ac64-36905cdaccb5", "comment": "Malware payload (AgentTesla)", "value": "425c49d3b27326aff3f3abfc6e5a5460", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924444, "uuid": "909bcdc7-c3eb-443e-84de-fe2ed50265ec", "comment": "Malware payload (AgentTesla)", "value": "d6f97400d822eaccbf90e7a0dc62b32e8073ad22185c28c065eca47bda82e044", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924444, "uuid": "b9d1a17a-82f3-4c88-a551-a1433df1c5ca", "comment": "Malware payload (AgentTesla)", "value": "c5d84657a14b1a25c110b9860114103a40ad973c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687924444, "uuid": "96c3e3de-fba5-449a-99b9-ad078f1797c8", "comment": "Malware payload (AgentTesla)", "value": "eda09c8ab3ab0cf4f1d4dbd2ac990648d5ffdf6784e507d20c6dfdc1e35861aaa94cb46fd850c8f15da151c850297595", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924444, "uuid": "4a8a8276-2232-4ead-b788-f055ee211f18", "value": "T192D46B3C0CBD6A33F079D6A98FE5C563F450D47B392A5A2265CBC7506706EA228C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924444, "uuid": "a5e6feff-ebd0-4d03-b380-6531f7471a88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924444, "uuid": "5f00ebe1-6e5f-475e-9fe4-c8635819511a", "value": "6144:pVVjexvCh1qDfcdXIyxBSQ1qTt23RPRWPDY35ZkCXielzUj7mi/tnRrb228RKS4F:I6ldXxxgt+RAY3Dbgx/1o2Dq2yfqWMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687924444, "uuid": "87f83be1-f1e4-4cd9-a62c-797dd827086a", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687924444, "uuid": "0fe55552-094a-45a5-b5af-5e28f6c7fe9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687924444, "uuid": "016d58c0-0e52-4f07-bc26-5659f4885cfb", "value": "425c49d3b27326aff3f3abfc6e5a5460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf42e9b5-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Meterpreter)", "timestamp": 1687961976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961976, "uuid": "f1f3f8d2-09a9-4295-b770-03e760ed0059", "comment": "Malware payload (Meterpreter)", "value": "7b02752921f9baca5c4c4a1da2fdbaed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961976, "uuid": "9f80cf69-316b-431b-b812-04e8b4229381", "comment": "Malware payload (Meterpreter)", "value": "d73dbd022ae04284c10281b7aad42b0b80d45deec6beee79858e635a43627f65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961976, "uuid": "7245a5f5-1b19-42fb-8947-8b3c3d347082", "comment": "Malware payload (Meterpreter)", "value": "557c7e2d9b0c16175fe28ef624c84cfbf95b56b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961976, "uuid": "d59ed533-f7d5-4cae-b1f2-40f2c9b88abc", "comment": "Malware payload (Meterpreter)", "value": "f34dfaa7ba9c41abfa12a13f00ec7cc9ac767e14ff9e8b3e1f9b01067b18b6ad676d30d91027bb69d072f56c34acfbc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961976, "uuid": "1a009e2e-3300-4fca-8ed3-86dd46586754", "value": "T10184BF681390EFDCE3DD8337ADFF6B2D25A08676270ADB26DD5214F209E92C142059E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961976, "uuid": "491cb0d2-632b-4e98-a631-1b260a0732ef", "value": "6144:N/OjPNackrJajupW53m3lIyEA3KbZLcMlsnuPhXC19z2jkmC7f6ZmnOaZbFIPuhM:NwNiaju4wBn3IZLcMBPhe9zUxCj6QbZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961976, "uuid": "a715de01-495b-4749-bee6-addb6df35f9e", "value": 380432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961976, "uuid": "3376e350-f405-4c83-b591-b88d2c15c267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961976, "uuid": "e7b24af8-423b-4a6b-b3a1-b0119c3af1fb", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0cafd5-1583-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687936360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936360, "uuid": "57bb207a-d768-4428-8f63-e98b1cde0465", "comment": "Malware payload (AgentTesla)", "value": "089db730f7e6cdf63e3a46f535bcbbe7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936360, "uuid": "b6ae5be0-c1cf-41d4-88ed-c060d46c1f0e", "comment": "Malware payload (AgentTesla)", "value": "d7a21a48d32ffe6331071b0c792603e0452cf6a1834afbd1167710d1416b6389", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936360, "uuid": "8bfaca36-7144-4145-aac5-7060fe211ee7", "comment": "Malware payload (AgentTesla)", "value": "f2403699ebd25953f7223de9ac690afa8e42ffe2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687936360, "uuid": "abc10e42-0eeb-4f94-bd65-49c65c7ea495", "comment": "Malware payload (AgentTesla)", "value": "5af3a891da24fc10194809c41637631ffd20d39b642786043a6b9496a879b17061653d0163e68e7bb9ebc126a1f71cc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936360, "uuid": "dd871240-5a4a-476b-bb33-ae87aa415b24", "value": "T1A6D4BEAC76607AEFC817CD76DEA42C64AA11647B430BD247A01311ADEA1DADBCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936360, "uuid": "54be19fa-4a80-461d-8522-cf433e9b0a5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936360, "uuid": "508dfd55-0749-4394-9090-5e1c04ef8b8a", "value": "12288:iluueew2rr6A3VQIqU6V7GcTZaewH088eaxHdfZdq7OTqIMbrEinmgOu8ld/TMrf:ileMp3CrUI7fiH085wdfLqqPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687936360, "uuid": "26759c48-de1d-4605-a2b1-49ae7aa48087", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687936360, "uuid": "0e8f4d87-fe43-4737-88eb-be0dc0b31ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687936360, "uuid": "68214182-e513-40ac-a92b-61e116bda358", "value": "SOA FREIGHT SLIP-223478950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897d9c52-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687935659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935659, "uuid": "ef610788-0498-4120-976f-984a4ac0dd5d", "comment": "Malware payload", "value": "6975a1c5b1f3db26f24d40dfafe1f4df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935659, "uuid": "a78aa448-7245-437e-a939-99fb02cca682", "comment": "Malware payload", "value": "dac7211f3ca9cf777825f6f1951d86234c95eb2a7d29db95114dd8233ac6d7db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935659, "uuid": "509d2aa3-f5c6-4bda-ba49-ad362c9f7c55", "comment": "Malware payload", "value": "943c79af76100b93b8c8a546940645a64eb6aaf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935659, "uuid": "19a7f1de-6628-49c1-97f6-85cf53152208", "comment": "Malware payload", "value": "7ce0ec5f9d3c5b893450135922f51a35ea4c7e1ed110a1f7beece04a4e2cb1b01c905ca5500fa3d8d131e5970f2d6a5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935659, "uuid": "bf06e12d-c59e-4c2f-83dc-6baf27b69d9c", "value": "T109B38D4F660374F8F2A600F8E78367ED3C63291C2E5EA6F2BC511237AA711C94569F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935659, "uuid": "5ab12ac1-4f5e-4f57-8ca1-760c313e1b57", "value": "3072:n2645g2/Z08P26qanWOMU0/28MB7jyfutgmPq:32/Z08P26qanWOMU0/chjRNPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935659, "uuid": "ad5f9bdf-64de-4a06-aa73-1a620541e869", "value": 116272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935659, "uuid": "83864d50-8489-42f5-b9b8-c78fedc14b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935659, "uuid": "38dfaff0-7b9d-42b2-ace6-fd4a0f949664", "value": "6975a1c5b1f3db26f24d40dfafe1f4df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bbc6e1-15c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687965609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687965609, "uuid": "d808f9f7-293e-40c9-94c6-65de80598960", "comment": "Malware payload (RedLineStealer)", "value": "5f46d71351eaa94763c589b62e73591a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687965609, "uuid": "8a9786e2-04f5-4f9e-816d-eb4767fa6ae3", "comment": "Malware payload (RedLineStealer)", "value": "dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687965609, "uuid": "769f038c-caee-4cde-94d8-59c7c7c2930e", "comment": "Malware payload (RedLineStealer)", "value": "564fb229ba4d5c2a3f159c53b48ae088926e752b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687965609, "uuid": "f944dc2c-ec0b-4505-8b48-c4e332c3941f", "comment": "Malware payload (RedLineStealer)", "value": "c41d2595dc6dc5de28c8733bed2d257575c4be90aa6708a09647bce586ecabe6b9d2d0fdc2123906a54666f5bcd6ef10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687965609, "uuid": "441f8373-40ad-4349-a096-eb6c9d516cbd", "value": "T13E747E439291BD55D9258B728E2ED3F8771DF6508E4A7BA57138AF6F04B20B2D1B3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687965609, "uuid": "e487ebf2-10ca-4a24-8e09-8324b4be5ee4", "value": "f4925062616b110bd402bdb61edf2e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687965609, "uuid": "aa7c02a1-ae5e-4837-a2e5-ab9901f4f0a1", "value": "3072:2E1fl8vhjeB9DFaP4CSox5yUUSvT7bPU/bAEP3WLWlpPKWqx8wAw7qqRAV5jwSnb:FGUPDePmUrU/93WCXKWqx87FwgwSui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687965609, "uuid": "bf3bedc9-98b0-45e5-8761-655cdbf47b0f", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687965609, "uuid": "cf0814e5-8473-460f-9f5c-aea04acf7ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687965609, "uuid": "f3709b3a-ec0e-4ce5-9d94-6fe105ded235", "value": "5f46d71351eaa94763c589b62e73591a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83538fdc-157b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687933072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933072, "uuid": "036bc61f-9df9-4686-ba0e-04f8e1b5faa7", "comment": "Malware payload (SnakeKeylogger)", "value": "bfae9efe11c70d20dc5ca6242fa54cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933072, "uuid": "4975b6e4-8eda-4f6b-a7ec-d248c4156937", "comment": "Malware payload (SnakeKeylogger)", "value": "dc80131e79439d1c5389385148733de4b917558a9fddd106cde38096f074bf93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933072, "uuid": "82cf7a2c-890d-4f45-aea3-107e0d80a298", "comment": "Malware payload (SnakeKeylogger)", "value": "3e20a6c4beade3b758e2f985709f0f1d526e5395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933072, "uuid": "87cf8b20-6bd4-4b27-a57b-591637b72aa4", "comment": "Malware payload (SnakeKeylogger)", "value": "899461b2334e5290a6651dc4da14df2f45a1f44246f11b23719883ca9adec24a3fa99e2fd3d8eb98f4f4a7720120f207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933072, "uuid": "5675fd99-0d34-4a89-8708-1047454536f9", "value": "T1C7C4583C1CBD2A37C174DAB98FE984A3F450857F39225A36A0D787654746EA325C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933072, "uuid": "1b037cd0-2a9c-403d-9b80-3622b6d64e0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933072, "uuid": "50d40f33-0093-468d-88c0-1507161638bf", "value": "12288:rb2iN9gngIQgUUxf+DJPjH+22+Wa56IIGZRcsPO/O7wqg27LyyCK:rb1egBU+lPn5r6IPSX0wqTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933072, "uuid": "0b994cdd-f1b8-4191-a295-837eb06d2d07", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933072, "uuid": "fca1a7ed-a3a6-423c-b653-8c2e29951fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933072, "uuid": "b71bb968-6159-4ecc-9417-24484d086731", "value": "4520007393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47450d6a-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687962606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962606, "uuid": "fdd6a929-12c5-45e4-aaab-7ee90b9edb25", "comment": "Malware payload", "value": "badb318f774c7b30e92e8683a1777833", "object_relation": "md5", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962606, "uuid": "fb48d9ba-be86-42fd-a4cc-7f251e02a1d2", "comment": "Malware payload", "value": "dd29c94a866d784dbee1d52f2d3d5fa1a288f6a9935b54097595b6c6fb1641eb", "object_relation": "sha256", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962606, "uuid": "40fce8e0-791d-4f9e-8842-c9c1dce3bde8", "comment": "Malware payload", "value": "1483794bb8e212ae1acd7967eed22f974fb70374", "object_relation": "sha1", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962606, "uuid": "60cfb302-d7bb-4aff-bda7-0f059698afda", "comment": "Malware payload", "value": "31515f392df9a48148ce60f727ffd356a673ca71176b9579af614faea0b714a57ff803de22e2cea43a3303fcbd9e76c1", "object_relation": "sha3-384", "Tag": [ { "name": "bjkataraedu-in", "colour": "#23A69F", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WebShellNirsoft", "colour": "#2127D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962606, "uuid": "797744fa-206c-4686-b3ec-fc0b47d32c91", "value": "T1C85423519D7899BDF2F0253D22CC01AA2A3C7579F35374DA84A386BA624373278F7035", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962606, "uuid": "ca878592-e9f2-472d-a454-3c4f635391c9", "value": "6144:QZZ0VTtBznH6myk/JsypQY7qvSjIWGtGb+imGGKSGzo3sUIZltB:QIVTLnXyk/9pQY7qvS8WRVmGTroAZltB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962606, "uuid": "79f8bfab-9132-49e9-86fd-35f60d8998bb", "value": 284394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962606, "uuid": "9de10637-161e-4089-9a73-fa305bf9e562", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962606, "uuid": "b06ef557-df8a-400f-a748-898650feb921", "value": "Specifications.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf036fb-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687961945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961945, "uuid": "011c3586-cd5c-4d85-8c3f-f5a4940d5137", "comment": "Malware payload (RemcosRAT)", "value": "341520ef0b9352ddacb0311024b15f73", "object_relation": "md5", "Tag": [ { "name": "341520ef0b9352ddacb0311024b15f73", "colour": "#5A93D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961945, "uuid": "13d6311d-a76f-4d2d-818e-c251ec9f8230", "comment": "Malware payload (RemcosRAT)", "value": "ddc516549845da0775484d40a3397df8e48b542d0cf7f1c2b1be413c6465ed08", "object_relation": "sha256", "Tag": [ { "name": "341520ef0b9352ddacb0311024b15f73", "colour": "#5A93D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961945, "uuid": "8f9bde38-0cae-4d55-973d-6212b3d84bc2", "comment": "Malware payload (RemcosRAT)", "value": "93d78c2476ac9f23ae9f47ccc8922dcca4f6ecae", "object_relation": "sha1", "Tag": [ { "name": "341520ef0b9352ddacb0311024b15f73", "colour": "#5A93D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961945, "uuid": "0b05b25d-ea9b-4fcd-98ca-49c38df4df04", "comment": "Malware payload (RemcosRAT)", "value": "fad15881b494f9437422f497ad09f4b97192867450b874f21a1f25883ef29c2e99fa5d13d4823f03caaeb42db1416979", "object_relation": "sha3-384", "Tag": [ { "name": "341520ef0b9352ddacb0311024b15f73", "colour": "#5A93D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961945, "uuid": "e2702099-e3c8-4f38-b2a8-cc5a8f8abb40", "value": "T17AF4E1241FC17CC2CA6DAF3CE2A2056EE959A06E74A2D7513D4520BC1692FCB0B54EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961945, "uuid": "b3fa3f8f-a313-4096-8b62-6726a4eaff11", "value": "24576:ygIJqd3BGAUy+zUAbQxrO1IftTF5/deL4:rvBwbUOU/tZ5VeL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961945, "uuid": "7e19fe1d-b72a-45df-bdba-45ad12e0c219", "value": 794640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961945, "uuid": "b9487f5f-f3fb-403e-9fee-7557979ea093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961945, "uuid": "ce3d9681-8034-498d-8eda-7c22d9adb74d", "value": "341520ef0b9352ddacb0311024b15f73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4e7e74-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687962969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962969, "uuid": "b2401036-11ce-4888-8bae-6a0e7d01b3d4", "comment": "Malware payload (STRRAT)", "value": "e1cfae8d53a78f3bf1c7b4a00d50ee8a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962969, "uuid": "2d1fe87c-7ba4-4be4-ba79-05bf5a77c306", "comment": "Malware payload (STRRAT)", "value": "df93b5395c2eb9211cbc3013a08d6e98b7a24b593f1160a2a6e8cb322f8bc025", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962969, "uuid": "9ab7520f-1488-4124-aa2f-1fe5fed6160d", "comment": "Malware payload (STRRAT)", "value": "c547607c397ca870d97e39fa1f0941fcc93c1ae5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962969, "uuid": "6344b360-378e-4f82-ad02-43ec32e10b30", "comment": "Malware payload (STRRAT)", "value": "f497444dcd2eaca7d8a697406cca4fc522f68328e9aec6ef3ee093096e9ea4adf21e340a027e0fd306b1da4cdf342395", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962969, "uuid": "20775655-7313-4849-bc1d-be8e94f9355f", "value": "T1A6240217A9F9E5EFE30B993A440491339E1A649CC015E23F52FC18CA0DB1DBADB168C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962969, "uuid": "7fc0c816-d0b5-4792-a571-fa10db7d66d5", "value": "6144:HHYOQp9F7erwK3JRZURdEZYtyHByqtp5I3r:n2Fq12mqyHFtp2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962969, "uuid": "251c3714-63f3-42a7-92dd-9f12fa98c4e3", "value": 224896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962969, "uuid": "79ac4331-03f3-48de-86fa-a478de560e01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962969, "uuid": "f37ba2ca-7652-42b0-9792-33f51b46aa84", "value": "PO 01-2302 - Kanamori.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c175188-1559-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918269, "uuid": "9254efa5-7eeb-41c9-a812-d04c5a748e27", "comment": "Malware payload (Mirai)", "value": "87730937e04bf667f5ebc481a6d2f43f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918269, "uuid": "59f79c8f-ab43-4ae6-881b-f8feabe2a280", "comment": "Malware payload (Mirai)", "value": "dff4575b7940116db55cf06086fd2b7b3cdf1b53b26a8cdbf73860b9aa9ee30b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918269, "uuid": "18003135-7676-4520-ba0b-dbcd15cf974a", "comment": "Malware payload (Mirai)", "value": "473fa280ba8ff95ce4094c8df3084a63251a7357", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918269, "uuid": "2e218a13-aa21-43a3-865b-e5c0b8cc88ba", "comment": "Malware payload (Mirai)", "value": "d1194c4f250cc73a8fd3d4db9b7c1f6f2d32b745bccbfcf2edccd35b8e3509e97c97757561c5f28a875fcb8a6e054fa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918269, "uuid": "586bee84-21c2-4e73-b93f-d76889ecf33e", "value": "T154230261880F9EF125303C76DBD59393B6E026B1C6673023D6180A3C6F75B231E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918269, "uuid": "c2cd4773-747b-4f27-8bed-2def5f44b4a1", "value": "768:5/TYCoIxdEk+AxoTZAZHFeq8b3kB9q3UELbUXfi6nVMQHI4vcGpvc:5ECFd+A6YHAxTLRQZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918269, "uuid": "0a65beea-e0fe-4c93-af98-668da859226e", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918269, "uuid": "601a08a1-2e67-4645-911d-9aae00321be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918269, "uuid": "f580b866-0421-4549-98ba-694db370e2d0", "value": "87730937e04bf667f5ebc481a6d2f43f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3194cd8-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687962009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962009, "uuid": "f6cb7c20-ae84-4bb5-8caa-84d0782d95e2", "comment": "Malware payload (RedLineStealer)", "value": "3cee746f843117966e7724707064a094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962009, "uuid": "6e387e3b-be28-4d39-bd69-31f6048286b3", "comment": "Malware payload (RedLineStealer)", "value": "e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962009, "uuid": "ab965618-c069-4c51-b095-6a85de22d99e", "comment": "Malware payload (RedLineStealer)", "value": "ce0ffc1d31a9243ea5f36e42cddbd0cbedfc621f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962009, "uuid": "de833396-2d01-442e-813c-a111682c1892", "comment": "Malware payload (RedLineStealer)", "value": "8ef8823cd646b82140a9c5ecad061ca9b3bbe05fcaf2513a1b17c2219c089c7a2e43d0d31d71f90d81a24e1f34eb663e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962009, "uuid": "59ad228b-625d-465a-9b30-5d5a21c91574", "value": "T10A747E439291BC51E9258B728E2EC7F8775DF5508E4E7B65B138AF2F18720B2D2B3211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962009, "uuid": "9a95ec56-b4fc-44e9-b2b5-b762af46fa75", "value": "f4925062616b110bd402bdb61edf2e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962009, "uuid": "3fcffe69-2369-4451-802d-1132f46ae48b", "value": "3072:Hd1SkqZ37tXpoLaOevZIRHtlGLmv6QH/Uf7dTv6ez21HeM8fM5cKFYMIvos9SeYt:v5k37lqJRGHfhv7Yc2js9U36j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962009, "uuid": "186d5a1b-2ce7-4648-aaf4-7c25aab91b63", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962009, "uuid": "9fe98b93-fbff-459d-99ce-4a91733fada4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962009, "uuid": "04ec97d5-4841-441f-9acd-d2648d060c9e", "value": "3cee746f843117966e7724707064a094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce30f6e5-159d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687947800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687947800, "uuid": "ecddde4c-1d3f-42bb-84ca-f36c26660e25", "comment": "Malware payload (AgentTesla)", "value": "b1c7fff887163b885c8953d5595e9162", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687947800, "uuid": "8141f10c-d6f7-4507-bc3f-a8a6c92ff6f1", "comment": "Malware payload (AgentTesla)", "value": "e2be51690e6e9020c2206683fdaae76b508bd1d17ca8926695348a6472932b72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687947800, "uuid": "8dd70a8b-93ba-4459-b041-f77e3ca7c1b2", "comment": "Malware payload (AgentTesla)", "value": "ddcf34d8dd6edf19d6b9a1f45d3496e484d161a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687947800, "uuid": "1ae81fc1-ecef-4fb3-9f9d-ca67f7e19cb0", "comment": "Malware payload (AgentTesla)", "value": "c664868f43b1b4dc1a76ddaecb90eeddf4c69baebb4eebffb6d5970d6f8ee7323652d4932b1605356f0a1dcd47cb79a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687947800, "uuid": "7cde26ff-b33a-4470-ba5b-4e97a44e96b6", "value": "T188B423F73203AE8CDEDE3727CD06F16AECA6919E0C1DE8DCA6A9B1D97A443450190753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687947800, "uuid": "940dbc3d-582a-4917-8649-53afddb2f559", "value": "12288:JiyC2R+Y+9ipYSjlGQOYBu9hh4/D1emPSRs3GS:JiMR+1YY7hoxhP6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687947800, "uuid": "ba1919fc-dd41-41aa-a0d2-a21da9e1ed74", "value": 523875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687947800, "uuid": "f61dbde4-bd48-477d-ab83-3aabcb8b24b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687947800, "uuid": "f3cbb12b-9651-4666-afc9-e515d6c337f3", "value": "Order CF 2023-24400.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbc5d47-15c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687963313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963313, "uuid": "93a025b8-2778-49eb-b64c-df952969f9cc", "comment": "Malware payload (ArkeiStealer)", "value": "f11de7628c58b4cd0bc3647984edc296", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963313, "uuid": "86e8d931-26f2-47ad-8e60-9bfe3010155a", "comment": "Malware payload (ArkeiStealer)", "value": "e356f807c297edf59ba7b0e1e0eb2a2186cc02246ad4bbe8d6fa42c7383b46c7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963313, "uuid": "4d66fdf4-7a49-4eeb-94d2-10edb759fb43", "comment": "Malware payload (ArkeiStealer)", "value": "5aa2db4791acb3f007ebadf6cad9ff9c9ed23ec7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963313, "uuid": "e522b085-f9f1-4865-bb7c-e359a8190236", "comment": "Malware payload (ArkeiStealer)", "value": "de202dee57c28110e76bfc251ee3adc19e25cd3025c768f13acc4ff0436ff166eda8859d122067100b668ec0b1eaf2f0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963313, "uuid": "8a7a4cf5-56a2-4df6-ad14-70f4f3bad87b", "value": "T13A74CF039691BC61DD12C6328E2EC2E8BB1DF9609F597BA732385F2F59711A2E573301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963313, "uuid": "1778a700-3c43-4807-af78-d7244cf87854", "value": "2b43bf869d5b33848beb3f85bf6ab192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963313, "uuid": "30f7ce19-9e08-42b5-91ad-93fc921f38fa", "value": "6144:Rcidmp9qgX6d6XGGX/TAeKfXg3PEYURPE:6X6d6DXUeqCRu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963313, "uuid": "8c36971d-be07-4e4a-9485-164ac36d6822", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963313, "uuid": "605f28e9-d652-45be-ade0-101fbb004987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963313, "uuid": "0aa835bd-785f-4e97-9510-8f9bf4bfe4c2", "value": "f11de7628c58b4cd0bc3647984edc296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04bb2b2-15be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687961924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961924, "uuid": "70e43c14-3251-4038-a99c-8e4b2ddcf7fa", "comment": "Malware payload (ArkeiStealer)", "value": "b5e0271a9b0243b2fd7cd10a59ea37dd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961924, "uuid": "90467155-812d-4439-a2cc-95a550920035", "comment": "Malware payload (ArkeiStealer)", "value": "e36cf15a41affb3946975d75dfa344a7d01fb02aab6137b085b9a494ed76fed8", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961924, "uuid": "226df9af-57eb-4ffc-87ca-2443b678ded8", "comment": "Malware payload (ArkeiStealer)", "value": "019f25a345833a70090ba05bdf1197187440b895", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687961924, "uuid": "f3c75d2d-43fe-41ce-ab29-f5815f1b9fa8", "comment": "Malware payload (ArkeiStealer)", "value": "698de1d27e7b338e1aae7ae414908e7c8e1e2a763677eee78fe01f1997f8673d2c0540ad7c76285c24394a9880d070fb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961924, "uuid": "dc5ae28f-fdb6-4566-be4b-3eadcc34c329", "value": "T189058A1C1E499E93DE95C1BBE0F354FEED1050E96A0EF6DD37481890BA91A10D3B8CDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961924, "uuid": "316a7a11-7fd1-4498-90df-cb818e662268", "value": "12288:euomg7v37DvDmTTudNqMb/288sqKxcs460TmkgckDc4B+XlPChGugMZGzWpkYnhF:gJ37DvDi2o+eyx06qPgHdvGtJzh4lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687961924, "uuid": "e8219126-31f5-45c3-bc92-40a1e47be912", "value": 820752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687961924, "uuid": "81355a32-41f3-4c8d-8acb-6d4074f3b3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687961924, "uuid": "ce47710f-a293-46ca-b9c6-7c8b96808e77", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c6dfd7-1558-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687918023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918023, "uuid": "43aada96-2ed3-47c2-afdd-a2017fb2f741", "comment": "Malware payload (njrat)", "value": "58dcb48b8130d5dee3a3865501f88230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918023, "uuid": "458a251c-248a-417c-843c-d045caab7de0", "comment": "Malware payload (njrat)", "value": "e37bf9be1d090c5fd6c300e2c579f585def5140d184eff2c04c2c995f1fcc6c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918023, "uuid": "25098959-4d78-43db-bc44-97cc4bdeb0a4", "comment": "Malware payload (njrat)", "value": "f901ad19e6a731cc1dec893e9aa0adb49fcaca51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918023, "uuid": "85d353f3-fa66-49d1-8d39-fc3d427a5cf4", "comment": "Malware payload (njrat)", "value": "0150f838deda35d9bf7fa99a6ab8c313af2dbf3ca5312755b0c99a347ad7efb56de769f3154514fdfe518ed474559490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918023, "uuid": "73953ee8-ca28-4841-a32b-2af7357be277", "value": "T1AE13E74CB694E174D5FF8BF1B4A2B2890B71A017A806930FD9F154D94BB3EC09A11EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918023, "uuid": "8776df70-47b6-42cb-a67f-a48c7aca32aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918023, "uuid": "225e229b-e077-4092-90b8-37124d9dc2b9", "value": "384:YZymSNUst+3gUy6x1ZcwoEwjdJEzQIij+ZsNO3PlpJKkkjh/TzF7pWn6/greT0pe:uWwQh6/ZFYjWuXQ/ob3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918023, "uuid": "5545ed95-0afb-4788-8db5-879b5e9733c9", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918023, "uuid": "506b1684-6314-4d5d-ad78-ef7a93fdb5ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918023, "uuid": "85b2a7e8-965e-4e71-9c37-2df93a65f5ad", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b9be28-1595-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687944275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944275, "uuid": "b86f8499-8c88-4b5a-890a-96b2e2176563", "comment": "Malware payload (AgentTesla)", "value": "5d63d1427a31e6e1778130f3b32aba90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944275, "uuid": "2376c9eb-d20b-4c20-af0c-1fe36c02e3b4", "comment": "Malware payload (AgentTesla)", "value": "e393f9b945d62e075866ef1bc51e8e1e71ef8e75d197e1a4dd457f79bb7c6bb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944275, "uuid": "4646e128-e53e-4d2e-a3e2-c6ae6fdfbe93", "comment": "Malware payload (AgentTesla)", "value": "5542f08b65bdaec82be50da2810b2507e7dd036f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687944275, "uuid": "d9d485ad-34a7-41f7-9831-c70903d49fa7", "comment": "Malware payload (AgentTesla)", "value": "1e28178e539154a9c27a16deeae9e745b1dd22b930db4d60c175e8388452865bbd2868ecd161e61ac25e78cf5ca5dd0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944275, "uuid": "6d4c9686-8766-4094-9640-6c1e45c7d5f5", "value": "T149B423298CAB37B058C7E176436AD454EA9E2711E6E68AE65B3000852670805DCFFFFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944275, "uuid": "28b55468-a9a5-4dac-8dfb-0dc9893e8c6d", "value": "12288:W68riep8dbsuaincax324OfZ0Bji6Af5Ol/eOiNg/:W68Gep8dbIincapR02o6AfoZef2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687944275, "uuid": "882308cd-97af-4910-8b2f-c52de3a6abe3", "value": 495692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687944275, "uuid": "da797b79-f80c-4b8e-a1b5-acb48f2a4b05", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687944275, "uuid": "39c0ad15-3249-4c53-829a-7a43ca43f75c", "value": "scan.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723b1f61-1581-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687935620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935620, "uuid": "749e5ece-109a-441b-ac93-fce5f084292c", "comment": "Malware payload (Mirai)", "value": "b157657152996242ebfbb115cb686d42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935620, "uuid": "218bbe1e-bcb4-49a8-a13b-237f3cccfc74", "comment": "Malware payload (Mirai)", "value": "e4dbb7e8b65a10c24ac151e9f0a0d4cc8019e2ff34450793aea99591561a0be5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935620, "uuid": "b9af8e20-3c48-4fb6-84cd-22eb2bb5afcd", "comment": "Malware payload (Mirai)", "value": "30a0982003178b0313032e837d0a6576c568e080", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935620, "uuid": "d719c50e-f168-4eb3-bb36-5fed1b6463c4", "comment": "Malware payload (Mirai)", "value": "dc89a88dc6fa3d5f39fb4f2b8e318630ecd955b2c7136502d02ec16a4c78ffaf74bf9539369a629bbed049ad9e813c24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935620, "uuid": "f8f16595-1b5c-47c3-bd09-debb3cdfc1df", "value": "T1E6D28D738D2E2C98E62E4938B5305F3E5B23E905EBAB6DE555224239D003DDCF9493B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935620, "uuid": "1e550b03-754e-4696-afcf-d56ba61e1251", "value": "384:x/tUcbnUanlDNwCdRc+RceRI6tNrtBxe0qY/x9yr/8yZb1QHj1rF7MAzsLDQ2WoI:x1UcbUadHdRfRfRhvlmPKo8atW/Mnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935620, "uuid": "e0d6f40b-ceec-4651-8058-de5b544fdd9c", "value": 30776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935620, "uuid": "fd418cb7-23f8-47b6-aa34-d658e7f76ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935620, "uuid": "10f5f8d6-95d1-484a-8b4e-a4e71facf29e", "value": "b157657152996242ebfbb115cb686d42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4f14db-159e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687948121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948121, "uuid": "8aa50afe-a537-4261-96e6-39e5b15ee653", "comment": "Malware payload (Formbook)", "value": "762d09e6f520c75b714fb22d8e7e4c9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948121, "uuid": "c5f62255-dcd4-4d18-9357-225513f44712", "comment": "Malware payload (Formbook)", "value": "e57feb419a6737804816cd7418cb5baf7b9807f6b937898ed5bdf52f2cbc6135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948121, "uuid": "d09e1ecf-afc2-4401-9875-8720eb7bf018", "comment": "Malware payload (Formbook)", "value": "ea4dee1ca2912656c006c72081bb0d89e11e6af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687948121, "uuid": "bae5a542-4298-4396-abeb-0071cf488f57", "comment": "Malware payload (Formbook)", "value": "1254ec08bca3a0e6faaf2f809a43697e3995e0673ec3015947bffdb29a70072f63a0229a92fe28ece2add4334e5ad3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948121, "uuid": "53a4593e-6ab4-4da4-a2ad-009b31aeff3b", "value": "T179053938287D0B66C178C7E98ED18063F3A4953F3825EA295DC367D90A56F9225C363F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948121, "uuid": "0a73ce65-2f9f-46ab-a726-096a8f673738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948121, "uuid": "f3ca76fa-257e-4eea-a1ec-cb0e73f14d2e", "value": "12288:yNB8eIaI3DEmh/hw1lNpT9UtfXVIXLRGv:yD80I3DEuhw1l/aXVIX1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687948121, "uuid": "cdc8c928-f424-462e-851a-012427bbae7c", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687948121, "uuid": "9ad6bd16-8368-4d4f-a7a5-251d9343f7ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687948121, "uuid": "2de01839-1030-4beb-88cf-337c4bec6eaf", "value": "SecuriteInfo.com.Win32.PWSX-gen.17373.8323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fd1d88-157d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687933966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933966, "uuid": "ba821942-d584-4bd4-849b-d119fc74a197", "comment": "Malware payload (GCleaner)", "value": "cfac553d2fce0ebbf1d0d82f4fa44427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933966, "uuid": "59909028-9493-4117-b364-74f0b3e40c9c", "comment": "Malware payload (GCleaner)", "value": "e5f9a14c54f197202a7c44d818ccce05f03d85ba96c807891f229f54bcf62fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933966, "uuid": "3d7c82d4-b528-456e-84ac-ed5dad221373", "comment": "Malware payload (GCleaner)", "value": "b3a7161871a037985f515811be95fb06890fc175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933966, "uuid": "2a484431-efeb-47bf-a69c-8257ab5ee4a3", "comment": "Malware payload (GCleaner)", "value": "b802ed4eddd54d090e8ceeb9f721045462cbe457fa45013ac783bb986826e20f49be99bc3e4f0d9f7a627a1ca60a511d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933966, "uuid": "a153fb76-b732-4687-afa5-7aa42c943057", "value": "T1A5846B3392B13C54E9254A32CE2EC6E83F5FF6538E6D37662218AA6F05B11B2D173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933966, "uuid": "bc4ff212-0364-49dd-8ed3-f8256011a59b", "value": "435e7ef59b3c6347cf62e2c58eef72c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933966, "uuid": "b91f6f9a-efbe-40e9-bb4b-70442344ab01", "value": "3072:cTl8EwAdxxQ8UOZy5A4sOcdnqR7vxxOi6DOIzs2FsSeGkERQ4pfxKP5NNVO2/uFr:U8qxxPUOigRdnql7TGnveGPRQ4KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933966, "uuid": "86aa6766-8adb-4697-9d44-72a372fe7536", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933966, "uuid": "20ef0504-1cf6-4602-b45f-c5e577957590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933966, "uuid": "89e0a78b-69e8-44af-9a3c-093be1e46a58", "value": "cfac553d2fce0ebbf1d0d82f4fa44427.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee75c2f-1580-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1687935024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935024, "uuid": "d5ba6ee6-add9-4765-96fb-9983e9eac497", "comment": "Malware payload (NetSupport)", "value": "2eb9ed4e2f0a2b1e31636c2bb4aeab23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935024, "uuid": "5b7ffc6a-9ac8-4451-800c-28ec1964af2f", "comment": "Malware payload (NetSupport)", "value": "e6aec9171a2000e4740775baa89114a1335f7b98439161c6a2c84338e50c113b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935024, "uuid": "57f1a531-aa3a-489b-acf2-b6df748c476e", "comment": "Malware payload (NetSupport)", "value": "6b03e2b3c524ff33072f0f5766ddcc59d6ccbbec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687935024, "uuid": "5021347d-b9d4-4d69-9fca-9f75d72ed2ad", "comment": "Malware payload (NetSupport)", "value": "37e5839f32e7a1bf0e9ea2ec02ff17d505daf816138283869911f044a0b06c3abc8e6e0543558f177477605af894279f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935024, "uuid": "382ea078-d980-462c-9ed9-d1a07a59ef21", "value": "T1D3657D26B6C38C37C0721A3C9C5FBF5997657E112E3CA84A7BE40E4C1E396417D2A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935024, "uuid": "538f76df-b3ce-4230-a4d7-1dce3f47ef99", "value": "64648ecce0bcf1e21a329d5e0935ce9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935024, "uuid": "2a03a8c0-c366-475b-855e-77fe46a30155", "value": "24576:24oIeQLLzA9BWpBu/5tTnqQeNNSaihqgovV8x4HhpgAz/4ckUZsB:xol22RtPzh5oN8iwOk6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687935024, "uuid": "44f0ee44-0f3e-4c08-94ef-dfbce14de9e5", "value": 1500832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687935024, "uuid": "f100b397-1653-4d0b-b44b-d6146fca8180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687935024, "uuid": "6d5af1ad-b8ef-49bc-a418-7fde916fdbfb", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13eea31a-15bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687960802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960802, "uuid": "23202304-0060-41c8-9cb6-ce27df301385", "comment": "Malware payload (AgentTesla)", "value": "efbb147a27b7824b93834ae0100efcab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960802, "uuid": "a02fc7bf-ff4b-43c3-bf74-ddf57fc24ee0", "comment": "Malware payload (AgentTesla)", "value": "ea36848fbd83564e724d8b4cfdd06f1763b6d6954928154d8d9715c6162432b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960802, "uuid": "d0a9a898-f205-41fe-9743-58011564c019", "comment": "Malware payload (AgentTesla)", "value": "46cafe3fcac19dd2a1910078df25a2dec4d5a2ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687960802, "uuid": "b4ed34da-d8c3-4e78-a689-c17619ee9978", "comment": "Malware payload (AgentTesla)", "value": "ff27e02c6383e55edc3df22614a24ae125d558df655683d4af1831ac9484bd2afa8c3a4e6604327bb59f3609b8265700", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960802, "uuid": "6765a559-224d-48be-881c-bcafcd140a30", "value": "T16FE46A3D1CBD2A37C074D6BA8FE5C463F550943F3922A92268C797954346EA325C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960802, "uuid": "26d4675e-1c4b-4537-9b9c-96bcdb0451da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960802, "uuid": "7542e6a9-648b-41a5-9fe3-52ba237c8278", "value": "12288:U9cMDYAfYR6NHSF4abCiHSN10tuIwQZn6w:UpUGpHSFFpyNmtuIR6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687960802, "uuid": "86885057-5646-49b2-9565-b9fe41d5387c", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687960802, "uuid": "e1532e95-7282-4190-8f81-a1b4a7644ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687960802, "uuid": "d323807d-183f-4f32-a4b6-8d93cdc9317b", "value": "80 TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1369107c-1559-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918281, "uuid": "35fe2db2-a72c-42a3-817f-872e79ccdd53", "comment": "Malware payload (Mirai)", "value": "7714a67c757e50e687ddf7697f8c4f26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918281, "uuid": "565edbb1-3661-4d2b-b65c-e66350b5c9ae", "comment": "Malware payload (Mirai)", "value": "ebe414bb2458221d96f31b0cbbe150b67a7932ef9bb671db8bce1ecc4f6426d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918281, "uuid": "dd8e5534-6669-4340-a844-ef8cac647a03", "comment": "Malware payload (Mirai)", "value": "5ddd4b38e2de1d446df39fdcaf6899c9eedd7f4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918281, "uuid": "6ed6e5cb-7e20-45c7-b626-6d080186f19c", "comment": "Malware payload (Mirai)", "value": "2935ecb688c75e362ea2a7e8eebf4bf7538de435ea1887d196210c948aee8160b057cd518ba0445682abc39e6b7d3a48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918281, "uuid": "9abc2bc7-b250-44ab-b220-6ac066a48dca", "value": "T183B2CFCD60943484CA8D7C7C1B8D4A674F6CA0D0BAED9B26E350CDD8B3AAA4B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918281, "uuid": "e40b33ff-29ea-4f47-bb99-d908339d20ef", "value": "768:chrQlS07dEv0UXqUhvQE+CXQKMQKCXBppZqaWvL4:KQlS07FUXqIYSXQKqu/qL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918281, "uuid": "871540cc-18ae-4490-81a3-2f444d891aa8", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918281, "uuid": "176d7061-abf6-47b6-a656-dd58069b0392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918281, "uuid": "2231a5f3-092f-4e18-bdee-4e312ae05a48", "value": "7714a67c757e50e687ddf7697f8c4f26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddc874d-157f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687934700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934700, "uuid": "2e5da9c6-4e3f-40c0-ac48-eedae12344ab", "comment": "Malware payload (AgentTesla)", "value": "212995d151424cd67203c990565621c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934700, "uuid": "285aff11-4f1e-4810-b972-05d8519022aa", "comment": "Malware payload (AgentTesla)", "value": "ed1a1b8dbe831fd0ecc35e1a98841da333edb55040a5bec1a2063e99d0d92020", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934700, "uuid": "72819935-83cf-4405-b274-30e4d11d1ad8", "comment": "Malware payload (AgentTesla)", "value": "117ec972e3d21a3634109829ba538457970e737d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687934700, "uuid": "1fc4e889-e230-456c-9a3c-a9df6c1dcbf9", "comment": "Malware payload (AgentTesla)", "value": "8f323316b56055f19e6c0d62d10039a6b0619856d4508b105f045e11cfc085f5f9fff4871c462f27366dec79dc89395c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934700, "uuid": "721b7a12-2123-4b08-bdf8-00fec4790500", "value": "T17F052214B7BF4013C8BF07FC586152B113AB3AE6B522CBDE0D9771EAA5E5B0645A0B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934700, "uuid": "4ad76df1-b47c-4fe5-81a5-8457ae7501bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934700, "uuid": "2a6fd0ed-3cf4-4606-8132-36e288625f81", "value": "24576:f1KNogIGOb7E5+YRFi2gAuXZ8w8WuV8lB:f1KNoYpo9p8w87V8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687934700, "uuid": "d74ef318-7076-47a0-9065-db8cfd18356f", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687934700, "uuid": "68c944d0-bc43-4faf-8e55-49fc18698224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687934700, "uuid": "e2408486-534d-4058-bcfc-ec9d808bc9af", "value": "#05-PL20200624005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c884cf-15da-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687973692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973692, "uuid": "cfbb53b5-3226-43c0-8d26-66b5872efcf8", "comment": "Malware payload", "value": "a6ecc90056e3e910c3b39624f708eb66", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973692, "uuid": "d8efb562-662e-4566-8695-1d22af65af5a", "comment": "Malware payload", "value": "ed660ae4e1ff7e57c133b6d3d0a72bd41d6058cd2fe827466afd9d1d372fd4b1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973692, "uuid": "a8338899-18e4-4d9b-96e5-f109cbb982ef", "comment": "Malware payload", "value": "72f6cdcdcf0114e50061a40078bc7cc60f7cd95e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687973692, "uuid": "ccc33af2-b480-48c5-87ff-85662fd82dd5", "comment": "Malware payload", "value": "1d70fbd52a75a244961348f2e2ade37026902f8ac2dc465274475ca56a2df2af36c0c1bd6983c6b2c481951b3bb2aca3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973692, "uuid": "99256edf-d62c-4025-8ee1-8d793e55df01", "value": "T16B4292850D307D81ECD8E0B57D6560509BE39AAFD3217A8328D7A0391E761FA252BFD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973692, "uuid": "88b811a6-2c95-4686-9917-4d925195d95e", "value": "192:Npy58UoGL9i5lB5HQmpikw1BRKsyj0B41HCAEcYnd5DvxR7Nl5:Cdps6mFqbKlv2zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687973692, "uuid": "be906651-345f-40f1-82aa-678e19b7d479", "value": 12094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687973692, "uuid": "28bac919-70d1-4ae5-bc90-cb6081e9832a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687973692, "uuid": "0c70f5a7-208c-4733-b2c0-014c2182c9ad", "value": "Tax_Statement_2022 .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0625657a-157c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687933291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933291, "uuid": "7cd57083-31e0-4b13-8d39-35600110d672", "comment": "Malware payload", "value": "f35f93a0950db0d73dc89468f65a90d0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933291, "uuid": "ecfd3c9a-90a8-4d0a-9def-554e9f6ddb52", "comment": "Malware payload", "value": "ef436975e5f283c5bd2e60ab75e85af7f3b7d0600ab128f987a18f0bffde351d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933291, "uuid": "41ff44f9-900f-4143-8cbb-df29b32451e1", "comment": "Malware payload", "value": "79a164d2842bd085b29a127b43778474e2baa5b3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687933291, "uuid": "17283e73-9f95-4aed-8618-4c29e617d949", "comment": "Malware payload", "value": "e5efbc0dab8879dff07a6c65b17088d1a3bd50fa27131e8aad6c6b41f5bf61620b3c8506dc88748b8c6f5aff54e0c6da", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933291, "uuid": "9005e584-221b-47c4-945e-3f473cc40f50", "value": "T11E83D52371648B27DDA986BF1601528107B3B767D32EC2898EDBBCDB70F5374A212587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933291, "uuid": "e0001eea-609d-489a-9f8e-630d3a384804", "value": "1536:7y3zlLe9EH+ugqLL3hS25KV2uPCrUN6WVTBp:Gs9EHnVj5KV2uPCrUN6qBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687933291, "uuid": "7f403494-83dc-4c38-abda-680d6c34c237", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687933291, "uuid": "bae7620f-e611-417f-8c9f-dfd89c031505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687933291, "uuid": "52bfd146-ecbb-40c1-8425-eec6a0d30355", "value": "DHL_AWB_NO_#90785388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863a090b-156e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687927493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687927493, "uuid": "1eb3e368-69dc-4d3f-bed0-27b19ebac7e6", "comment": "Malware payload (AgentTesla)", "value": "b752e011acaf9c9cdd6014d99e82abed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687927493, "uuid": "a9307c30-7b83-421a-adb9-3495de0f70f7", "comment": "Malware payload (AgentTesla)", "value": "efce0d3460e779ec7823a7b1dcc3adee2d39f6671c3bdd1fa61e3cd641e982e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687927493, "uuid": "2050235e-765d-4d78-acca-a094ac3702f1", "comment": "Malware payload (AgentTesla)", "value": "6d676cc623f7b112d03c6bfdfb2edaf81a26a2d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687927493, "uuid": "5f1fabd3-c2b7-4dff-91e4-a9889873c642", "comment": "Malware payload (AgentTesla)", "value": "3d9ef95f293bb3d7380b8ab2060f54b64b41163dfc6c1a5e6a79e9b37bdd92e450c55fec56c68e1c2a1dce6e5773f088", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687927493, "uuid": "5b6066db-2b18-480a-9f79-b51184bec105", "value": "T101E4483938BC1627D174D7E78FE3F423B2B8982B3021E92568D657D90686F4225C763E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687927493, "uuid": "47543229-05db-4e75-8209-00729ae9ba70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687927493, "uuid": "bcc93137-707e-4d84-a3c3-a4908f28976b", "value": "12288:25dPG2fVdP/iKJtiixOPY2UfQK672i5UzZOUXM3GOD41fv:OVp/iKn7b2UfQK67pUzZ0GODs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687927493, "uuid": "c110fcd8-42fa-497a-b000-21eda9ea568f", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687927493, "uuid": "994f0ca0-bab6-40bc-9fe9-c425eff2f1b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687927493, "uuid": "4ce074b2-3efe-4c24-877c-3dce0cd24491", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ddd82f-15c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687962678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962678, "uuid": "871060a2-8a87-4a81-9dc3-e39859ca0784", "comment": "Malware payload (SnakeKeylogger)", "value": "e5060e6758a0ce2ba036278bec5f8681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962678, "uuid": "50c8f61f-0c2c-467b-885d-15d69e6b33c4", "comment": "Malware payload (SnakeKeylogger)", "value": "f15efc199baae5de89401024d42aa136fe03c1cfbea1c8eba689a5e832d83289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962678, "uuid": "295d776d-706e-40d8-9463-f3ad2f460437", "comment": "Malware payload (SnakeKeylogger)", "value": "de0a0a915f99638d37a9ad781ddb14d751a124fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687962678, "uuid": "c7844824-a693-4f1f-9eef-9278218db18e", "comment": "Malware payload (SnakeKeylogger)", "value": "c4675714db5fa4ca46ad230bffd8b2f521befa89216d02ca6835bd103fed92e75328ac5e7845499598147f55e7661974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962678, "uuid": "213ce236-5144-4703-9dfb-79f32ce3d7ff", "value": "T162E4083C6B7D9A22C034D6B5CED584B3F2558F3AB411D522588A7BB52722B921DC333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962678, "uuid": "f0f29c7a-4e80-43c0-b628-c664216c226c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962678, "uuid": "c1de9e09-f79f-4397-bb37-92f0af2f8a3d", "value": "12288:1cj6ZC7WJv+cQ6j+ZFkbE6yS7Rqf6I77GIKReQ8IRaEUVM:acCaB+76jmM37UTvGIKgQ8caE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687962678, "uuid": "159ecabe-0ec8-4dfb-b589-eb82c788685c", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687962678, "uuid": "60691c22-7564-498a-bbee-38999f07f271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687962678, "uuid": "5d808bcb-4d8d-4cec-8001-fda70e49de1f", "value": "PO-1120011658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda42b1a-1558-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918245, "uuid": "08fbe7c6-8fe7-4ff4-9029-3e52b2ad0f27", "comment": "Malware payload (Mirai)", "value": "6d80443b8cbf516b909b20cdd98d9575", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918245, "uuid": "850ba39d-4d16-4f50-8436-c4ca757d9b86", "comment": "Malware payload (Mirai)", "value": "f1fc0f5c042e79af9bb5af056a006f8c20cb846187f0b7954fedd0902920f827", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918245, "uuid": "7d9b3918-f488-40ec-88d4-a7b55f15fbe5", "comment": "Malware payload (Mirai)", "value": "da7325b299e2c1f0d5499c248a54911d865d3b01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918245, "uuid": "fb9bff2f-8634-4917-8c60-da032ee4e661", "comment": "Malware payload (Mirai)", "value": "b5fbb5c0f4777a66adb81cc0c93c25692490cb0a937a84b2da062b8b3a5a908076132a555643fc3fafdd8e52f9382cc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918245, "uuid": "3c337f75-fc34-411c-bd4c-aa9ab55c0820", "value": "T115432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918245, "uuid": "c969b43d-26cf-4dec-a7cf-256949ed0735", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwi:RqtmZPuutfbltZFBSJsBcfDSTFI+BEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918245, "uuid": "04010639-6a11-46bc-815c-811a2a5ee91b", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918245, "uuid": "f0683897-c347-4efc-95d0-2b1605c21440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918245, "uuid": "45b0fce5-33f2-4ed1-9bdb-6208bf77cf0a", "value": "6d80443b8cbf516b909b20cdd98d9575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078404e3-1559-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687918261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918261, "uuid": "46544b83-f15c-4f26-bbf1-da597b26c8ca", "comment": "Malware payload (Mirai)", "value": "39eb0eefaa55d5e09602fc2b8a09344b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918261, "uuid": "3502746a-9b71-4caa-b503-148c9e1d0fb2", "comment": "Malware payload (Mirai)", "value": "f21d87bea1bf7196f8e612d9ca4633138b83ef77fc58d9f649ef7a8e55932d80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918261, "uuid": "51ea4d59-61ae-488c-8f19-e80ef326bda7", "comment": "Malware payload (Mirai)", "value": "35b5898b7625c1d7d0aa499a00c00d49e144b8f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918261, "uuid": "61704e3a-33b5-4c64-8eab-9fea8e2d9213", "comment": "Malware payload (Mirai)", "value": "56cc9bb2a968a05a915561eb3e6c0d31184a7396ffd36ab3a6ad499fee302ac17cc4d094d4c09f996cd8b0af58028773", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918261, "uuid": "660d6efa-a262-4fcf-a3cf-1655fab06902", "value": "T14CB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918261, "uuid": "51dfdfa5-f1ce-4cb2-b6af-3dcd9c789511", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1l/LWy:c9sSyzz36YaWWgg1lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918261, "uuid": "8c5dc3a1-1ff4-460d-a8b7-2e8e4bdb426e", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918261, "uuid": "0f2710a4-94aa-4234-8390-a435a1bfdab5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918261, "uuid": "b0bff949-2aea-4da0-b4f8-613615892c08", "value": "39eb0eefaa55d5e09602fc2b8a09344b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e287301-15c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687963853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963853, "uuid": "db500dd7-045b-419c-9572-7d33a3a56d5e", "comment": "Malware payload (AgentTesla)", "value": "3631416e8020ac058e48f786769650e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963853, "uuid": "17dd8d83-4d70-40ec-bb4a-2d2970501625", "comment": "Malware payload (AgentTesla)", "value": "f2286f903d9e0fd383ee8dd7bebcc90748c408fb24d43bc66a3ff602173fe6b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963853, "uuid": "7c3d227c-9b77-4bf3-83e6-bc139baffb58", "comment": "Malware payload (AgentTesla)", "value": "c5b2af05c476ea9a3c1a07cb00d1d80beab6bc0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687963853, "uuid": "1bb0cde3-c864-4222-beb2-b0e731d240d1", "comment": "Malware payload (AgentTesla)", "value": "a8f2b7a9ace9496a966b572124d03843e23ce7aaf3039fd9094c8cbc6c629f4ba86739ef0c462a175ac9666839035ca9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963853, "uuid": "7672b93a-ca26-4e8d-9fb2-1d3ea9e39811", "value": "T199F42838287D0B66C178C7E94ED08023F7A4953F3829EA295CD367DA0656F9265C363F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963853, "uuid": "dd73f6a0-0a1d-48bf-afae-0cc4313326f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963853, "uuid": "c7428fb4-c367-4281-8771-990c86dbf4c1", "value": "12288:WNqV0aFrljmYImQ/bnQJVehFssGemBI22Zuhwvp/Me7kZaoOgORFb:WQV08Jj4/8JK9moZuh6pEe7kBTOHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687963853, "uuid": "90da2646-feb8-4e05-98f1-843597bc190e", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687963853, "uuid": "7900a53c-77d2-40be-976d-6dbc71dcfe2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687963853, "uuid": "a28be4e7-9f02-4f2e-96a8-19849d5d904b", "value": "uploads_SUP_pahajster_REQ_VERI-S2342327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca152fa-15cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687967877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967877, "uuid": "01404eee-9a83-4613-9597-b091038f4de1", "comment": "Malware payload (AgentTesla)", "value": "bd5699f60fba007a7c16fa13dd46b3ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967877, "uuid": "02ab1cca-d95a-4e1c-a243-853b04ed3c65", "comment": "Malware payload (AgentTesla)", "value": "f24d872f7b39540fc137f8e348c0aed12d0162bebaca879775ffecc9ac2acb9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967877, "uuid": "fc3bbfd1-3cc7-4331-92ce-673bd364e4cc", "comment": "Malware payload (AgentTesla)", "value": "be8590393c6ba737cceaeb97e2d519adadfcb2b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967877, "uuid": "cbbbbce9-9315-4031-b97f-743c25fc598f", "comment": "Malware payload (AgentTesla)", "value": "599791a654cb008d59f0a3adddcd60158a5f393e849e1737fc7c32cbce3d4a11037052aa6bf4aab6bfb9e477eba084c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967877, "uuid": "b007a45f-5c16-4be9-924e-642fd33c8db5", "value": "T120E4373C18BD2B27C174D7EA8FE48063F664943B3922DA2559C297D50756FA229C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967877, "uuid": "9f331087-8864-49f1-8e82-05cfe9b32c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967877, "uuid": "c815b79e-d66e-46ac-955c-3465ca2a4e41", "value": "12288:tmRYXnhgavB6cUWeq10JVQ7I8eOqumtYiXpDK3j+zz:XXe0QDxq1kGqZtpXpDKSzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687967877, "uuid": "273edc06-e988-4cab-910d-c9782d2d9750", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687967877, "uuid": "0e74d164-9fcc-42ed-9ffc-db602f574868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967877, "uuid": "33721bd7-5392-4f37-a4be-7cd2f25f7b25", "value": "Ordene FC22068032478332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06376d95-15b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687958632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687958632, "uuid": "93a2f2dc-e2db-4374-a0e0-38fe27c6c723", "comment": "Malware payload (RemcosRAT)", "value": "7bf88cef73ca9069380e626e99d0bf5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687958632, "uuid": "fd09e691-4054-4290-baa3-edb028d782f1", "comment": "Malware payload (RemcosRAT)", "value": "f3576bbb2c1a3343f88610d3c039e75197015117d3516de36c09f638f6f2a85c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687958632, "uuid": "32079433-230f-48ba-9501-3c848fe368d8", "comment": "Malware payload (RemcosRAT)", "value": "8f2085d21be660ec40eceb496053fb8390497dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687958632, "uuid": "2008206f-ecff-40c6-a40a-6dcf72227c84", "comment": "Malware payload (RemcosRAT)", "value": "9d82309556af3e86cecf2f46cf825301a9de2a59ddcd6ace73e4155d1dc1db708ea9e9028150e95ad920e14aa7d90b9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687958632, "uuid": "1f015ea3-631f-4f74-bfc4-a357b2e887f2", "value": "T1D825BF5775D0C4BBCD7266798C8B9AB4BC253E243A38B801FAD43E1C6FB525538192B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687958632, "uuid": "358aabe1-70bc-4850-a016-a3836741427c", "value": "b2ffe640086070c19351a52301f6fb90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687958632, "uuid": "2e61b241-16ef-4d1f-be7c-bcce97bbb6e0", "value": "12288:zWI+n1cF0p4WhPQbXfu/i7Nx29T1CWaXqIov5n0fc8MMvdgV25wqYyEyHcsbOonD:z28tWhPKXf9PvXqgfvcQrEyHFbOwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687958632, "uuid": "10785972-3fb6-42d8-96c9-26ea277ee07a", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687958632, "uuid": "bb889b1b-e744-40ec-9724-ed5ba509876b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687958632, "uuid": "704482a0-4eaa-4640-930a-196edd2a0e34", "value": "IMAGESCANDOCUMENTSFILES001201020.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e3af0b-1556-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687917364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917364, "uuid": "96c5a3e9-dd11-40f8-a78f-00575a9c8255", "comment": "Malware payload (RedLineStealer)", "value": "9896399d70df56ae91fe4863ef996ee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917364, "uuid": "1223a444-9d8c-4586-890a-bd0fc4694f74", "comment": "Malware payload (RedLineStealer)", "value": "f3797caea303b796ae9130ff619adcd0412e45b0b1c9c67ec565c825d000a4ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917364, "uuid": "f34b414e-963d-42e2-bcfd-3be3bd61e9e1", "comment": "Malware payload (RedLineStealer)", "value": "a2beacbcfccfb434e19ff3a16d0ebf3e3e327875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687917364, "uuid": "aac0e9bd-09d5-4345-a778-24126e9f5399", "comment": "Malware payload (RedLineStealer)", "value": "c2e9adb0ab711e1c5b441f59ef7ebeb1eee12578bd043677af196302931db005b2fc8cd6403ed1f4aa10822f325a9581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917364, "uuid": "c07659ec-2f82-4dd1-81a1-efc1c3f77cb6", "value": "T16A946B3392F17C50E5264732CE1EC5E87F5EF6538E6E37A62218AA6F05B01B2C273650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917364, "uuid": "369dded3-556d-4596-b231-fe8d55e68aee", "value": "ddcdb1c08a1de8d683d90430b0a24222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917364, "uuid": "0606d4ec-c895-4e31-8edb-4cef33d6a75b", "value": "6144:SWvgo7fAiNUlABkKxGBlRH7K2QCE8E0dU1a+8xqA5:SWv9fAiNL6K4lN5QCDq178xqA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687917364, "uuid": "465494f9-ae3e-4730-be9f-8f6cf1a76daf", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687917364, "uuid": "d4bcbe96-aaa9-465e-b991-27dd177b84b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687917364, "uuid": "5f872119-3d80-4ede-8e95-2245304d6a53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2068fe3-15cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687968020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968020, "uuid": "b06fc902-6496-47ef-bc99-921000a5ddcf", "comment": "Malware payload (AgentTesla)", "value": "d14379d74462281fb9d1dda8faefc851", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968020, "uuid": "0c5dd2e5-0cae-44b2-be16-1ea3b62c4e1d", "comment": "Malware payload (AgentTesla)", "value": "f405134e5b1e953d5d845e537f74b02cf7ab10402df7020f6bda89ee8532cfba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968020, "uuid": "db4bcc05-35df-41fb-86d2-b3ce22e96739", "comment": "Malware payload (AgentTesla)", "value": "4eaf2c68b0d1838a40d544440b6e9c78ecd4309e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687968020, "uuid": "241dce9a-287b-487d-8020-a57b63015bc3", "comment": "Malware payload (AgentTesla)", "value": "b7ab25d323d486869845d693f8f36d04d50ce61992a2496f821732b1ee0a447a390fc9cbd9abe21b897a258d3fdcaa89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968020, "uuid": "606fd093-baae-4ce5-a68a-5a81776786ae", "value": "T169F461BD29802E97D475E5B2C263088DF67F7032BF138D6B26D252C5862552E37ED80E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968020, "uuid": "7864a6b4-0b42-40f7-ab98-6f780d34b821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968020, "uuid": "98936e4d-cfd9-47d3-bb44-f84af4df834e", "value": "12288:ZKnh31z0T55GkKhHkQbErcxWyI6VEoRAYjJn:0L5hxbwcxWyVEonV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687968020, "uuid": "6aa1c348-e706-4e9f-87ce-ee7f6695850a", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687968020, "uuid": "07d12efb-afd2-4564-a47e-1bc5339dca30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687968020, "uuid": "49f9d4ea-d529-4186-89a0-07da1d5fd3b6", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc377cda-157a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Lu0Bot)", "timestamp": 1687932765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932765, "uuid": "1a577fcf-6a87-45a2-842d-e16d9f571a99", "comment": "Malware payload (Lu0Bot)", "value": "b8c98b14888f48405173bc0f44c1c98f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932765, "uuid": "fcab6ece-1d20-4893-8075-d64c2d79dc77", "comment": "Malware payload (Lu0Bot)", "value": "f4b15f591e0138a46f1f5fd157f31a78b360624d72a18136a5269a05ba8b987c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932765, "uuid": "8ddd7567-90d3-49d2-b1d3-3b27aea3c22c", "comment": "Malware payload (Lu0Bot)", "value": "88d9407dc689a02070693ed6f95251926ceee37d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687932765, "uuid": "244dc97a-8c18-4cac-82a3-87721a2b7af0", "comment": "Malware payload (Lu0Bot)", "value": "0b84b048082260f1c74e91715479e9adf3604bdefbbc6fcc5e78a91b1962bfc284a07f3e2c4fcbc7c740190e5c885301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932765, "uuid": "5779e6c8-664b-4d8a-8900-cdb85af909cc", "value": "T1FBC53362CAC89D73C4A4233415F843771A36BE65CBA403AB7B51558FBD726D0A1323BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932765, "uuid": "80f93bce-c373-46d4-ba0e-ca4b2a1b178d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932765, "uuid": "2246ce3f-4b1a-40e7-9d5d-2c5dbfacbd94", "value": "49152:PIVMAWRywiN7AqzGKWPy3tsdWT69leSkFAaGjv616z1dUbtmFjpb3JFjGgcBL:AKo5czXmidWn1FOz6c1uQF195GLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687932765, "uuid": "a958b107-4a3a-4f97-84fd-b3cb833cc177", "value": 2648744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687932765, "uuid": "5f868daf-ceef-430b-81f1-828c0b12c3b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687932765, "uuid": "cbc1055d-15c1-4cc6-9cff-768cb39818e9", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bac247-15f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Meterpreter)", "timestamp": 1687986172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986172, "uuid": "b827cd25-f3d9-41aa-b249-6c829122d032", "comment": "Malware payload (Meterpreter)", "value": "49c60e3d55583dd83ab272712aacf144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986172, "uuid": "d3371541-3bb5-4d96-8445-788200f32b1e", "comment": "Malware payload (Meterpreter)", "value": "f5da41544be205f34d1d63d711a728350eb8f0254e419d2a39c14cb07c50f338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986172, "uuid": "a10a7267-d2d0-4e7d-ad4f-d8c3810c205d", "comment": "Malware payload (Meterpreter)", "value": "8c0e6d883458f603ec845b7e2ea9ecf5fae96b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687986172, "uuid": "006d73a8-c9aa-4b9e-9b2c-12a7f372a83b", "comment": "Malware payload (Meterpreter)", "value": "ce62a54a135be68a33fd1d141a27b41855884e2122fc32c35ac0b151e936916efec4b92fd54a8525ceb36d816f2d1636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986172, "uuid": "a451a9ba-5504-48c4-8648-82751696c86d", "value": "T13773BF42D5C41465C156127F2BB13B3A6974E5BB3212C29A3B4CCDE5EBD1CB0E26A3CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986172, "uuid": "6e2a9b6d-b110-4c18-b0b2-4c12d67024c2", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986172, "uuid": "0361c566-a5af-48fc-9887-ccd115e280fd", "value": "1536:Ierud3idMAtVSYOA3NDSHOUPcqJNMb+KR0Nc8QsJq39:vruAMAtVSY1NDUcINe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687986172, "uuid": "595228e3-b596-49c7-a4bb-aec931e44e16", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687986172, "uuid": "511b0f83-ec9d-4d32-9db8-6efdeda7cafb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687986172, "uuid": "2928a97e-f8c0-4001-b8ff-86e677a4bde9", "value": "file25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc88c92-1558-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687918007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918007, "uuid": "516732b7-e1ec-4b33-9e53-5b2cb2f2f2da", "comment": "Malware payload (AsyncRAT)", "value": "349b1ea1f71f95d0f4d3f90a470d34d2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918007, "uuid": "9a55feca-d250-4b72-80da-f019be3d83ac", "comment": "Malware payload (AsyncRAT)", "value": "f70c31e042f65367e91089caab4a4b919211369f132fc8b9028f5607d574c00b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918007, "uuid": "2f6c6a65-b95d-4c8f-96fa-e0863cc1ab98", "comment": "Malware payload (AsyncRAT)", "value": "639c276fe7303562432aad9e6c9fc538db5d57be", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687918007, "uuid": "178bb541-4829-4279-9f8a-308c9423106d", "comment": "Malware payload (AsyncRAT)", "value": "b64dfdb2ae01822d0010c1d92828b1d7a3bea09970be9e4e7d2d05055042409e4aa22f63a1ef27844ec206447f147c16", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918007, "uuid": "b1f44c19-24fd-4f24-9b58-b227fcc547ac", "value": "T14B04391437E85919E3FF9FB8F4B002258BB2F823A517D76F189458EE2D62744D910BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918007, "uuid": "c8874cf6-b0d1-41b9-8180-f740c93816c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918007, "uuid": "c1c4327c-92b1-43d5-9943-59183db52166", "value": "3072:S+STW8djpN6izj8mZwP900qo2HD9avlCIPu/i9bSJ2chB6Y6+WpP:P8XN6W8mmP9kHDYd/PSi9b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687918007, "uuid": "e65ee52f-47d7-419f-b39e-c6358333427e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687918007, "uuid": "a40bc946-ba01-4b7d-ae31-9521a4fbc15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687918007, "uuid": "cdc3cacc-850c-4802-8680-25dd19b22d0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7eb8e10-1553-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687916061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916061, "uuid": "af1899fe-5af7-413e-92db-039de72140de", "comment": "Malware payload (GCleaner)", "value": "ec571f31f07305e6570b9c095fa38035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916061, "uuid": "3d8323e6-1af2-401a-ab07-3cf36d120806", "comment": "Malware payload (GCleaner)", "value": "f77c4cd95258a487da134a7537ba181ff528e07116c5a96887e315bb2d20213a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916061, "uuid": "3d9fef34-4306-47f5-9848-230233059583", "comment": "Malware payload (GCleaner)", "value": "13bd6b6c41f64f599814b723f0d4f041d4d2f8ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916061, "uuid": "73ab7f6f-6452-4fe4-9f5f-dc3ffda8701f", "comment": "Malware payload (GCleaner)", "value": "d2c09b958f4b58ad30712443a5fc522fda3da429e30e7586d70aeb0f28efe6fd64ab4a3b5c823c745d0d222cb8048ada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916061, "uuid": "ccc6c41b-4a62-4ad3-8d7e-1f641ce21d42", "value": "T1DB452356E2AFC4B6D3A249B04D650C1525377FD8723DA54AB00D94AA1FAF3C04E4BBB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916061, "uuid": "d5165f38-4649-413f-a9ee-3a6ee964c060", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916061, "uuid": "563bf42e-68d4-4ded-94e1-6ce6757e29f0", "value": "24576:kfOycjxT61Dzkz02sErhezVzhJC24FyjXh05TPYSgO5N/fkBtP/hNy:kGTTbz02sA8JzhJJZOgSgmN/fq5/3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687916061, "uuid": "183af2f8-31fc-4cdd-adce-a6b38620d563", "value": 1279172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687916061, "uuid": "cb7f4a40-eb8d-4d09-8612-4226835586e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916061, "uuid": "0a94ee54-570c-4bdc-a25e-2d5da5e168d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4575b552-15c5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1687964751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964751, "uuid": "3b6d8d67-ff13-4e1c-990b-f9ce64da5a0a", "comment": "Malware payload (ModiLoader)", "value": "d00a46f5daea7a5705d7d77cba001ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964751, "uuid": "b20f9117-b76e-407e-8316-1d8cc6a69e19", "comment": "Malware payload (ModiLoader)", "value": "f7dd09c86b9eac79499a0f210a294906a2c40978b579613f2d49273cfeac0bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964751, "uuid": "74f53c9c-e4c8-4082-8adb-249bc9e02da5", "comment": "Malware payload (ModiLoader)", "value": "e4c10a8c1b050918f2acb1e6a4f5e30bb7c8ff2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687964751, "uuid": "e84a642d-c5ef-49fe-b203-d36d1a48b585", "comment": "Malware payload (ModiLoader)", "value": "358f92a0ab38191f20684caa6a6c59c993687d951d8b2d2a6a35cb2a83e3bc957cb346348794ac417dcb66285a04e372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964751, "uuid": "05aefabb-e297-4d48-a34e-9245da95c6d4", "value": "T105F49E22E3B08977D1F229BD9F0A63D5841D7D312E68B84A2BE73D8C8B357C16B15187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964751, "uuid": "1159a5d0-c259-4470-b1f9-64e79c334a08", "value": "98a14ebfc80ef3213b316dac83bc983a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964751, "uuid": "df92248c-776c-4042-b802-0d153d8a17cd", "value": "12288:xDHePoS+SvqbAI5isRe3eIMVWGDqHG6LbO39Qjj9CGUSnzQ6Kwnn:xreg7bAI8sRT+tpjJzQ6KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687964751, "uuid": "ce376e74-be63-4d58-893d-52a41c46431d", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687964751, "uuid": "19d73d81-edee-4553-b5ec-9edab2e7825a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687964751, "uuid": "a4e8e2c0-2195-4352-9866-dc823dcf7a0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ecb710-15f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687987131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987131, "uuid": "a8c75116-89c1-4123-90fe-f1d564364de7", "comment": "Malware payload", "value": "acd36c213ab68025b8abb920345754a9", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987131, "uuid": "94ad76a5-3cc9-4438-8444-ac8bfa21a8c8", "comment": "Malware payload", "value": "f8954756782c6b8180ba447bf373386e8112d17cdc196a30f88addbf608e25d0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987131, "uuid": "7926b006-3656-4409-8a75-7e43f7e71aa8", "comment": "Malware payload", "value": "0af9df1f6b1ff94f33897a0cd9fad4a620ca609e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687987131, "uuid": "20b3ce5d-3777-4496-9a84-76f28e5e2f01", "comment": "Malware payload", "value": "f99e5065bbd7d7b47d09e94d64b8b59c5df82e89e6a9b9c1d1f7e429bd9067153b0417084331e63b10055d648286abaf", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987131, "uuid": "cf6ff24c-c2bb-4f91-9e68-419065f18f14", "value": "T18561E1932051B8EA424283BF3E496AFA807FC224915A7044F78C4F5DF9DDE23398D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987131, "uuid": "889e63c0-834a-4749-9e07-9d0e3fce8494", "value": "96:BGTLzeaHuSHWFN+CfLhL0HxImAiBrVMoMVW:yve9F4H6mAiBrVOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687987131, "uuid": "fb73dd4c-a955-41e3-b6c3-4364162541ad", "value": 3235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687987131, "uuid": "9383cc77-6375-4985-ab00-322f33d0c62c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687987131, "uuid": "ae61069f-2c71-404f-8749-89104ae7587e", "value": "payld3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9ac7ee-15e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687976364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976364, "uuid": "32fa68d2-0dbc-40cb-8893-b70ca6ee53cc", "comment": "Malware payload (AsyncRAT)", "value": "11ecad91dc9e0e9172e74481a2a91829", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976364, "uuid": "42274a14-9ffb-427c-a08c-2d60a0df478a", "comment": "Malware payload (AsyncRAT)", "value": "f8fc2647fffca9883e5eb6cc375c4efafdb56d2f4a11fce3b4444dadfb51d0cb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976364, "uuid": "a9620ba7-474d-4e90-a8f6-20bfa83aa112", "comment": "Malware payload (AsyncRAT)", "value": "45d8ed7f3855452b332f7b13e66f360238b68295", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687976364, "uuid": "ac7cf477-bcad-4e9e-b50b-6701a518c7c6", "comment": "Malware payload (AsyncRAT)", "value": "da46b5930adb1ea33d80c98f5f46df5de1529562d58b28120a5b4f9444a833817338ee5aa7b064337aca7a70d07058cb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976364, "uuid": "797baf3b-f64f-4246-aea1-7bf4c268b363", "value": "T118233C003BE9C127F2BE4F789DF36245867AF1673602D64D1CC442975A63FC29A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976364, "uuid": "33339612-f8c2-4ba4-bec8-02a4c101d2f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976364, "uuid": "5b717b0e-b039-4631-8344-eaa79e228899", "value": "768:iu4X9TskvpDWUPANxmo2qb6NH2GrrPI2s5QC0b/hAHiTmovAiwwAe5ZKBDZEx:iu4X9TswI2r22sYb/hciTuiqe5ydEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687976364, "uuid": "263669ff-94b7-4401-a691-3396f5b48e0e", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687976364, "uuid": "aa912852-2e43-4f5f-bcb2-738e11951866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687976364, "uuid": "09a11968-2bcf-4318-8460-688007ab0621", "value": "xv1Nd2aIIxRn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed77548c-15d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687970187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970187, "uuid": "2efba3cd-829e-4f1f-9ecf-c321adee92cc", "comment": "Malware payload", "value": "42c949896f36865721df77cebebd9705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970187, "uuid": "7d9a8aa0-c19c-4a61-b756-0f4f6b6e491b", "comment": "Malware payload", "value": "f9f1b8511b6a2f81a35a80fff4880d38fa00c30b10ebb5aecccbfcfb1ff086af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970187, "uuid": "0e8ddeb7-6aae-4377-a712-742eef4ea981", "comment": "Malware payload", "value": "2c9fd967cd744340f133ab997280c62c6d1bd2a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687970187, "uuid": "901e0cf3-7548-4ae5-8418-1f9fc687ec9a", "comment": "Malware payload", "value": "ec7f1f48ef1e0220ca32bad1a31b2d209b40c6d46d563432eaff0ea0370888397ba48788ab029c315375d4c92e602b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970187, "uuid": "f14b4f47-7bbc-46a7-a9d0-b7a145c56e88", "value": "T15FD49D0423EC8B56E2FF5BB6D0B29151C371B5666A2EEB5F5D8024EE2D23350C911BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970187, "uuid": "f4928ab8-3d00-41a3-9fdf-21d765860bac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970187, "uuid": "3f81e697-9081-446e-ac72-1354e1997c1d", "value": "12288:LeI8SoKDZLJLUf9snBS4csPYae6qfzqAA:9oKDhhUF54clNf7qB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687970187, "uuid": "fa8541c6-e872-4752-9944-a094967f6ee1", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687970187, "uuid": "f88d4137-dce0-43f2-93a0-29e2507174b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687970187, "uuid": "f0fa2341-b77b-449e-a0e3-33752f95e826", "value": "Echelon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f21161-15f1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687983911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983911, "uuid": "94cb721e-2b25-43aa-837d-a1c91f908aeb", "comment": "Malware payload (njrat)", "value": "bff805513210c836103c8ba988a1aee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983911, "uuid": "86b2ec79-2eac-4132-b66e-daef2b488b5e", "comment": "Malware payload (njrat)", "value": "fc029a13dfcfee8a324499a1be4407bef2e72a6e1bd6ded7f561b6be9a2bc131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983911, "uuid": "8feb09a3-47e1-4929-91b5-ace48f1513f6", "comment": "Malware payload (njrat)", "value": "71a16020174e0b8430282f0d0b654d48df61e30a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687983911, "uuid": "f60894b5-9320-495f-81bc-848e8d7d323e", "comment": "Malware payload (njrat)", "value": "c9bc7ff6f671cba10e1879a3f5be5447be56fe3482dca1a3e3091673a4978d42c442a06d680de836197ce6090e793111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983911, "uuid": "65b29492-fc06-4ff1-828a-fb679508fcb6", "value": "T192432844BFEA4A05E2BD8F3468F655150634BA63E532EB1F48D668EB13327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983911, "uuid": "49f8d11b-697a-4275-a115-bf6fbed060ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983911, "uuid": "e015909e-45f9-4163-8a15-5aa4a00039f7", "value": "1536:swjs4DnAN7jytFADKwsNMDtXExI3pmwm:PI4DnA2PADKwsNMDtXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687983911, "uuid": "bdd46787-b8f8-441c-b2ab-720c92a91757", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687983911, "uuid": "3a0a1548-c511-44a6-8970-f83f4f44e946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687983911, "uuid": "046848ff-b605-423a-858d-65adc1b08336", "value": "bff805513210c836103c8ba988a1aee5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672b0def-1555-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1687916704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916704, "uuid": "60c1f090-a4b9-4434-965c-dbea1be4381c", "comment": "Malware payload (RaccoonStealer)", "value": "be3c6e00030583fbb28a76db091bacaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916704, "uuid": "86916419-72b6-4928-be1a-d68027a28ecb", "comment": "Malware payload (RaccoonStealer)", "value": "fc9fa1695c11f2c3a8019b64b414137c47d1b2f57b8593f44eda1237e4b3293b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916704, "uuid": "1f2ab460-6df4-41d5-a0d0-1d0c208838e5", "comment": "Malware payload (RaccoonStealer)", "value": "993f02561c8654dec8d1ae45f8aa50d46d8d874f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687916704, "uuid": "370b2ee6-f87f-4d9e-8151-149e975f6340", "comment": "Malware payload (RaccoonStealer)", "value": "e4ad6d5b5bac9c5ea4851335ed36598693c5de0e5932e311de803008d5fb26be04976f6d41ca22de3a01172e1f58640a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916704, "uuid": "4208a714-5aa2-4aa4-a7be-9af7e7ecb56f", "value": "T1186622123154C245E6EF41B484339F64B5F2876ACB0298B4F9ED63E71B279ADE323907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916704, "uuid": "1b3d735b-919c-4bc6-8ff4-6b6249203a3e", "value": "d0296b5fd58041cb2b2f3d944f62e133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916704, "uuid": "b1f967c4-5d96-4e86-b862-cfbaa2286723", "value": "98304:uCf8gAi14hArd2whqdCicBKM+f4c/E9EBtLuVik2uUGixgJ85/e8VP:MDY4hADqrTdK9UG2uUGecMmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687916704, "uuid": "5654a50b-bcc1-4532-9be4-6e1dfb467c63", "value": 6928896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687916704, "uuid": "3ab876d0-b069-4001-80bd-1965410029ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687916704, "uuid": "87a2ce37-61c6-4a5d-8d8f-5b8bfaa671ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfccce4-159a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687946243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946243, "uuid": "6d751288-6f3a-4fa4-926b-4529f26be92b", "comment": "Malware payload", "value": "076682947cdb70a184620aed267a64e5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946243, "uuid": "123fb564-bcc3-46dd-aacc-5cf60d7836ec", "comment": "Malware payload", "value": "fcfa8b7b8dc0ef9d2a4baabcd78551c0ef1b2b505180d30ee1729298013b5204", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946243, "uuid": "30e99402-bd5d-4401-8100-de1a4e6167c3", "comment": "Malware payload", "value": "49a78fd9ba854e7e2a16276cdd4188ade83ce384", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687946243, "uuid": "ed04087f-120d-4cac-b39a-e887aef78e82", "comment": "Malware payload", "value": "d977ef7f27fa23b63a94c4e78c21d605356b1e3c753ba751f5a3e0c4fdb22ab4f43d8f53b77d3f8145a7112495478ed7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946243, "uuid": "654a9283-d13e-445d-b181-af499e47d5a1", "value": "T15CA58D1275CA8732EA7E8134A5AAD73621FA3FE01BB154DF53D4593A0EB05C242B2F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946243, "uuid": "9d721ac0-9acd-4ddd-a9be-efeca94f0671", "value": "49152:2m5DxGSFVtaN4AyK8tKk5ojmrhCMz5vk3ukDln/hFRFNUEekBIWsRkn4frUMXjDA:vxM4AeKknz5vqu0sRe4frUMXjTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687946243, "uuid": "4a38b9b9-6ef5-4e4c-aac6-a393942c4891", "value": 2252800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687946243, "uuid": "0f18e4e0-7fd7-4df5-a11f-e94d6684230b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687946243, "uuid": "31a018d7-6317-4726-a427-aee0d4247986", "value": "Fatrr_UewhcWF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ab776d-1587-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687938012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687938012, "uuid": "f77ba754-91a0-40a9-8e6f-0ac6d0cd5ca4", "comment": "Malware payload (AgentTesla)", "value": "6c8df164e3bd5b2881d622f0838ff974", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687938012, "uuid": "23bba0db-b2a0-4f61-a82b-5fd196727c28", "comment": "Malware payload (AgentTesla)", "value": "ffb4e52f0da5c1e91f6286f5124afad7d02c54f490a966396cf05f760799467b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687938012, "uuid": "a2f2c36d-1d26-4b2e-8f59-9897919e444c", "comment": "Malware payload (AgentTesla)", "value": "274b64cb967196f8d3411bbd3612450a8d1a6ac4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687938012, "uuid": "f2d27887-2e1e-496a-9735-c3b04ba49232", "comment": "Malware payload (AgentTesla)", "value": "a6b8fa6d5d55c28bfb774b9d72f3eaf725724e85ff6ba85416e375e4aa1950d1270eb0b9c085cdcc3a2a75f9e0cfe5a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687938012, "uuid": "8a05a86a-a7bf-44a5-b0ba-9bc26a054688", "value": "T1E7B423993A1AB691F4FF00B8F9FECE20C17C57C107150AF5B7421E9EC7A608DA44AB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687938012, "uuid": "5c5d0f23-4342-4ab6-a9a9-9baa9db98100", "value": "12288:BJZFwtFn5CcLOUz+AQjNyTT9PRnYzVcq2H0:B9wtvCcHQZyT15Hqu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687938012, "uuid": "4a7d8ce8-01db-4f3f-b58c-a70afc1a924a", "value": 527413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687938012, "uuid": "a9bab2ee-8c9e-40ca-a829-391a30376968", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687938012, "uuid": "063724c8-5bae-44bb-9ca9-1275760cd8d8", "value": "SOA 6680085911.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096d3898-15cb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687967227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967227, "uuid": "6990b4dc-faa5-4685-b405-64acc664a9f8", "comment": "Malware payload (AgentTesla)", "value": "b53face1427c7c7b2a6bc33ffd5d58a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967227, "uuid": "761b334f-0be5-41e2-92b4-0999e9487885", "comment": "Malware payload (AgentTesla)", "value": "ffc129522f78570b8ef721893a067705d3dc875fc1f2bfda9f96d4cead0e4d67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967227, "uuid": "fd106264-9e30-4cdb-8e48-d63b50c92012", "comment": "Malware payload (AgentTesla)", "value": "79a8a14818e42581c005cf09ab3421e5fd2b926c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687967227, "uuid": "7b641c65-8151-4ae6-8e96-55ea1cc5d66c", "comment": "Malware payload (AgentTesla)", "value": "491107fae5a2c0fe5902236ad4766d9cf3995c661af9872db77e3bfcd66c9363efc3d29bcf262f7efd54edbfbbb44997", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967227, "uuid": "4d1609a2-741d-4df0-81ef-6870df88e4e2", "value": "T197E4383C29BD2B27D035D7A98FD48063F264943B3922EA265DC297D50756F9229C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967227, "uuid": "43c71093-50f9-4746-8f9d-24e6bfbdfb37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967227, "uuid": "5b5f62b8-329d-4e8b-a83b-bef4370a70f1", "value": "12288:3mRIv5oC8SVWd22A/RhLRAYjtpH110hvnB1nJHdyrhUjwduFdTY:DvDJo2FhFRh3Cd9Hdyri5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687967227, "uuid": "04e5a132-b9ea-4881-8a30-9d76bfd5dadd", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687967227, "uuid": "10da3d3d-22ca-40af-b015-2844a30d2616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687967227, "uuid": "50679209-639c-4e17-8861-b3a7724adbbb", "value": "Comprobante de pago. Exp. 9815.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }