{ "Event": { "published": true, "date": "2021-07-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-27", "timestamp": 1627430582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "54c41975-2014-45d3-9670-b4a355f4081a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9bf1a9-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627372089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372089, "uuid": "9d8baf44-f980-4587-9a58-b4e4235a463f", "comment": "Malware payload (Dridex)", "value": "98cba5d4e3bc55750e6716b3d952e375", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372089, "uuid": "21f1cfff-a7d0-4cc4-b163-2c1676ea76bd", "comment": "Malware payload (Dridex)", "value": "00072be4185289677e5babb9fda5279b5c2886683ebd7ea22d36f4bc9683b3e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372089, "uuid": "4887f01b-8d51-4538-8bb6-b2cc8b370534", "comment": "Malware payload (Dridex)", "value": "2b8ae91d2d044eeae4456fb000cd92583abcdfe3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372089, "uuid": "7ac4166f-0100-4b5a-9cd1-045eb37646b9", "comment": "Malware payload (Dridex)", "value": "57f73f546c714561abf629afe8080e4c784fcaf504284d50452ff27a36d5a0b6fe37ded36a5a0a05948be1aef3e57d6b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372089, "uuid": "16929f15-2432-47c6-8e8a-8389024cbefc", "value": "T11504D061DBE759C5D7A3C57ACC8CA17BD1293C0B8A6CD27C6208D2CC897AF0CC6A4D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372089, "uuid": "182eae45-050e-457f-b72a-feb05bdaab46", "value": "89aebe8644a760ddbd7c2e801228e7e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372089, "uuid": "10dfbf9d-1641-40de-a939-35943e33a586", "value": "3072:NyNLuxQI4JTJlYDFS6t2NAgEaakq7MCi6TM7E0NfFln:Ny5PB3ot2ygEasni6TM7E0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372089, "uuid": "34a9cb49-51fe-4983-ad04-05cc1bc01f8b", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372089, "uuid": "1f46c3a0-b619-4c33-a765-6603dc22a9bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372089, "uuid": "135c5597-1561-4001-a587-f2faec3499b2", "value": "hsy_utu8_12u_v4.4.7.0 (5).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711c4a72-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627366271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366271, "uuid": "64ed5e58-f12f-408b-85ab-59d11d01b6b0", "comment": "Malware payload (AgentTesla)", "value": "46231727958e6b8bf2f2af9eb1883ee4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366271, "uuid": "148194b1-7e91-4601-acc3-959162dcc3d2", "comment": "Malware payload (AgentTesla)", "value": "039dd5bcf3eeb08484663983831f1b6c61fcacb35a96041ab11e22855f262023", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366271, "uuid": "a966e021-8f2d-4259-912a-6c91c11f45c4", "comment": "Malware payload (AgentTesla)", "value": "ee13a45718a614a5512ca289ecc60755561b2ae0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366271, "uuid": "befd89b8-6d86-4bca-ba96-48b67d1306b0", "comment": "Malware payload (AgentTesla)", "value": "c5d21ae5cf565a2ade6c71a1f109eda307c4aa6050cb60817e7b513ab5b0b7b37d100f2be02000231ccd16d48ff0b0f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366271, "uuid": "a96b7285-c04f-424d-a088-ec6afe67c5c9", "value": "T15B712AA16AFE2489EF5549E6CCF8FA7901E1B52306D125C935CEE9A1071B33D5A12C12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366271, "uuid": "c811a578-7897-4851-bfa7-1b7427e6c3e2", "value": "96:TyI5wFRKdm+cuRzKEdjiW8XOw6fDF9XtlUR:T9SRKdmvuRzKEdjQXORfD/dla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366271, "uuid": "3c795873-4875-40bb-8800-552d20be4f10", "value": 3814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366271, "uuid": "c004da62-c9b6-4471-b1bf-f227e80d55bc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366271, "uuid": "da9830a4-7ebe-42c4-a595-e4db1ca32841", "value": "RAW Material Inquiry for Supper Alloy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f822f115-eec9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627383678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383678, "uuid": "94288fa3-1925-4531-bf27-4410b640a247", "comment": "Malware payload", "value": "a62c57ab406e69b371d9047dd7eacc10", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383678, "uuid": "fb6f4220-2cf5-4989-bf55-a311d5dbf7e7", "comment": "Malware payload", "value": "0458e2c96b3514cfb5f202d0c25429862e38d78cf4249b66e674d4a27ddb2c03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383678, "uuid": "00097f9d-d3ef-41ec-8572-bb18880b8441", "comment": "Malware payload", "value": "75126c19baadebb6d82cb42595343d3c29d651fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383678, "uuid": "b454a8a5-588c-4cf4-b65e-9dce6aa8d7dc", "comment": "Malware payload", "value": "8ec064e91203df3774cab365283463f2a759b5ab4db8e70e12c5fd01e3daafc2f3356a49d910a1be1d18f2a389776bae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383678, "uuid": "6fe21058-6bbc-41ad-beae-0ee802e07166", "value": "T1C242E885ED92D191C8CD13BBBD1D89CE3303B3A5D2DA3292DE0D5F18B2CA58D0E65583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383678, "uuid": "07ed8484-7175-4cce-b245-157ce073dcc7", "value": "192:ClcTnOaDjV79bAT9SK0WIyDZA0LB9XYkTl89Vlscw8a+CT6uBOR0Rt:CMnLhb4FlDZAsB2Jh+8avT6uB9Rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627383678, "uuid": "2e82a91f-956c-4ed7-8e99-8eb1fb99f2c9", "value": 12600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627383678, "uuid": "7f105f53-76ee-4f15-ba9a-b3aceb463772", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383678, "uuid": "be437991-79a6-4531-b12e-87044a2e91b6", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fd6451-ef36-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627430266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627430266, "uuid": "069e9b94-7319-43b9-891c-f5a1b64b3c14", "comment": "Malware payload (Formbook)", "value": "9a649c1d193d55ef7f66e59b8294f24d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627430266, "uuid": "63a1171e-97b7-4ee1-8ef2-acd61d0a7403", "comment": "Malware payload (Formbook)", "value": "04657288f9e931379d2c526330b23310c8bb26d65a209a2ebca5fb089b91efe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627430266, "uuid": "666d68d6-dc1b-4806-8f9c-2d2dd6cc8381", "comment": "Malware payload (Formbook)", "value": "e4c00ec807de5111c061ebc5d8421fe0d0114fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627430266, "uuid": "e421fdd8-a1f1-4d5f-ab82-55983d4614b9", "comment": "Malware payload (Formbook)", "value": "8d99e2d15058c4378130f6490808a9c59048808aeefa5419861c1469ca9ebbb03d0e48d31349f9f16f989c642d6a23b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627430266, "uuid": "e3241367-5b87-49a1-9f96-c1da0ced40d8", "value": "T1D115AD3804685B63D639A3B7C125A354FFF15E567250EE1A4E97F8C32E127031A8EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627430266, "uuid": "2bc065a9-3530-408c-9e76-8052864a2c3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627430266, "uuid": "44d17015-ba67-4078-aab4-4b5c4ef53711", "value": "24576:vmvC2arO4+yEARzQzUllGKNXZwjAdMP/RzzYmR:OK2ry300sKNnMP/RPYmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627430266, "uuid": "18023dbe-ba46-4abb-9074-5ee6ea77e349", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627430266, "uuid": "3e5643e9-15a2-40cd-8560-b349ed0d6020", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627430266, "uuid": "5cc9e50b-3f51-44cf-afbf-8fa6d9536642", "value": "PO_9756-NMNBVC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013da220-eeb8-11eb-875b-42010a9c0053", "comment": "Malware payload (HawkEye)", "timestamp": 1627375962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375962, "uuid": "2fd5d304-3c02-4181-8786-c0a876b77b68", "comment": "Malware payload (HawkEye)", "value": "08d679d4b9a12137756cc9244bd6f017", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375962, "uuid": "b24b807e-fb07-48e6-9aed-ceca2597a7a7", "comment": "Malware payload (HawkEye)", "value": "047f33e6f83796d9fc056d7006a6e8ef69696d63eceb29fb1592bb13a62e79bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375962, "uuid": "3e090cd4-57fb-4021-94e0-fe1c23a51290", "comment": "Malware payload (HawkEye)", "value": "580c29bc356057d76873c9c453ed466e1024b7f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375962, "uuid": "3a281d7c-6df9-4dc1-8f97-d32c0805a484", "comment": "Malware payload (HawkEye)", "value": "6866df8c002a16ea7187613f38bf1b0c7f5b027fabceb9b6807303100bbc6af27cccd2fb051d94f61bd19582525326a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375962, "uuid": "1d7778df-3394-4ee6-a019-a87c5e67432c", "value": "T14555AE3A738EB659C13509328B45E5C743F4EE0F7762E2DF298912DC6D03A69AE3E051", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375962, "uuid": "7b56652d-f7d1-44c0-96b2-685fd0429e16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375962, "uuid": "e6aaeb5f-709a-4d97-a5a4-d24f157b8f15", "value": "24576:1pMP/pBvygA8z+uhHJQNmR3X2rhK1+pSRs/N:1pMt3qu3H261Rs/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375962, "uuid": "736fe872-55d9-4fda-96f2-a6a70ffe58cb", "value": 1287680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375962, "uuid": "881fb21f-192a-48f4-a24b-46745ff79ed2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375962, "uuid": "94c3df43-c7c1-4c70-b857-cc07fe10dd31", "value": "08d679d4b9a12137756cc9244bd6f017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50af9374-eeb1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627373089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373089, "uuid": "19bd03df-1c0f-4cd9-8465-3d9a66edf6cb", "comment": "Malware payload", "value": "92a9626c7da7b2e83ffc085503d472dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373089, "uuid": "01df7303-b598-4190-8425-d83fcd14fb58", "comment": "Malware payload", "value": "04a3042944f0aeab3f11c71769513509a2c697bdb0a19b8d0cd42a9f77d5b987", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373089, "uuid": "a5f4575e-6bdd-4291-ad27-5bd9e3dc11bd", "comment": "Malware payload", "value": "9eb0f57b72a6ebb0be7d6c2008cda52e4dbd70fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373089, "uuid": "ba5ae353-e294-4917-8241-ba2533ab602a", "comment": "Malware payload", "value": "dbe3fa420ab527584c24a4404734db77f6d86c90d1b41320155773a62fd049b6cc3d38191c7683567700931b07a81ddb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373089, "uuid": "bad40ec6-8c58-43f5-b13f-a6648556f74f", "value": "T1494251EB1B860377114382E9769CB5EDE37AD16C65B7A5507096C0381780EB2C73AECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373089, "uuid": "258a19a6-a5f0-455f-8a44-a182d88c7511", "value": "192:ssSFsIi899LsFFIHzXVls9fsaSuHiRIHzFsUsEsVsG:ssSFsIiCsFmHTVls9fsarHtHJsUsEsVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627373089, "uuid": "800ef692-9d8e-44fb-95c6-6a17dc7036ae", "value": 12143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627373089, "uuid": "a8afa845-7cfe-4657-953f-20784c881165", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373089, "uuid": "78591519-a0a6-4355-8723-9f8b725d2f28", "value": "theParamTypeSmallInt.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3b8d82-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627400438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400438, "uuid": "6530e9d4-7f03-4c76-8416-6184e9c301cd", "comment": "Malware payload (RedLineStealer)", "value": "fab18787863297968fe1c105420d8465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400438, "uuid": "8b4b2416-45f3-4442-a7c1-bcc6077a8a69", "comment": "Malware payload (RedLineStealer)", "value": "04a7438ab8d6f9429c0ae2856093431cbcc974f753862d726caa0d4bc8eef916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400438, "uuid": "8240a54e-ed16-40ce-aef3-6a3f50e03b60", "comment": "Malware payload (RedLineStealer)", "value": "f1069e7432ba125ee7c4eb67064b817134095ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400438, "uuid": "16ddd40e-3845-4bae-8a9d-fcc24199d42b", "comment": "Malware payload (RedLineStealer)", "value": "2d398b8476aa2007639888d8c9d34803dc1c23d1bc2191ec53d3326987bb9d0b424e5da39f68aedbb735671a6078577f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400438, "uuid": "e2dca182-d5b5-46b0-b1bc-b464047dab14", "value": "T1E7E4E020BB51C038E5F212F849B593B9A63A7EB1573410CF62E53AEE5A346E1DD31B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400438, "uuid": "40706023-9f7d-452d-86f5-83103424f42b", "value": "0724b6e67f50109c65fd8c6025d37cf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400438, "uuid": "2a731721-0944-4238-97c0-dc2620189096", "value": "12288:2A5bS6X8zSTNMpiHosu7DQJRTkOI7GEfAA8ANdg7IY0qH0xv9VYLK3:W6X8zflswMRxhEfAADEkVqUxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400438, "uuid": "73080878-056a-4ac6-a1f9-99579ca9a268", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400438, "uuid": "51c7b68f-936e-4a7a-bbbc-31d759cc11d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400438, "uuid": "a6827683-77b6-4d51-9a0e-2d2625541c6b", "value": "fab18787863297968fe1c105420d8465.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9101085-eebf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627379277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379277, "uuid": "7f9af4a1-b2f7-4e1f-b163-21c5cad006fe", "comment": "Malware payload", "value": "e3af1ce972568bbac119a750ae14f1ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379277, "uuid": "91f0970b-b512-43d8-89b8-7af1c64c6f79", "comment": "Malware payload", "value": "05cdcf92fc6acf883bc144b53786b927b30a2f1acc228f677c582b94c591e4ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379277, "uuid": "8acb38a3-8551-4108-8243-597903ff1de8", "comment": "Malware payload", "value": "b345ac922c6a8a8bce0160b102c40d6d9dda6beb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379277, "uuid": "1373ab9e-4c08-47a4-afe2-431c2f717660", "comment": "Malware payload", "value": "aaa57d852d70fb6b843b709da121c543c080288f13c49cb85438d71dafd482009339ab90defd106aa55be5bedd0f16da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379277, "uuid": "95981e16-ca9e-4b24-a0ab-8535b960e5c4", "value": "T1E4A412342B94EA78CCF8597A12EB18980F9A4F474823D1BDF0CD578E3267313A51796B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379277, "uuid": "804dc2b8-8b5c-4693-89a4-6f817d2f5c06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379277, "uuid": "a7958461-846c-43f1-b658-f71d9bf5ade9", "value": "12288:dkZkvuDgW3bBuwYIHKpPonLNe8zZkDEnX8n7:dkQu0WrBzvJZkg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379277, "uuid": "1b19a8f1-d3a5-420d-9bb6-ca914d915ce1", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379277, "uuid": "6e6384e2-c39a-4ad1-883c-8852cdf8f719", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379277, "uuid": "0111f564-36ad-4a9d-830e-3e2ed26d8ea3", "value": "e3af1ce972568bbac119a750ae14f1ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec8c196-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1627399795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399795, "uuid": "772701fb-19f4-4ff0-8fc3-3be82f537699", "comment": "Malware payload (AveMariaRAT)", "value": "391c3bc7f5534306976f645db21ff085", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399795, "uuid": "9b902438-5a5a-46a1-8c13-7136bdebcb9b", "comment": "Malware payload (AveMariaRAT)", "value": "0618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399795, "uuid": "d1170b47-42f4-416b-8cd8-6c38971e5d05", "comment": "Malware payload (AveMariaRAT)", "value": "4b20940c605a93eef2de9853a180431165e7e16d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399795, "uuid": "0d6e0c77-1c94-438b-9426-79dda0800398", "comment": "Malware payload (AveMariaRAT)", "value": "52efd88a5b53ebf766455235ade46be31a90f59252a631407f15f9c374386cdbdcbd50b5568f1dbd02aad73a55015e12", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399795, "uuid": "cba94a1c-6dc2-43ae-ae9e-80058d998766", "value": "T186A412302D5EADA7E2BC5B34563B8E040FF29F532B69D29C929D059F8F1B780C612935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399795, "uuid": "fc21bf74-a5a2-4ce8-939f-163a3c874641", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399795, "uuid": "de37f3c0-77f4-4530-956d-f772a409c261", "value": "6144:5mfrmligS3SIxQ779yAYZcPaCaveCQ9M2jw8jWmqwP9D12bPZJOAFmnh+VbyIkel:5mfGigtBbJV8er8VDGoNoipy/VPUHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399795, "uuid": "0b84ba46-c6b8-4f05-9939-b732425a2859", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399795, "uuid": "9d59a6c3-4dea-401d-9901-256ec8365ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399795, "uuid": "9243d63d-3c7c-4a8d-b6d5-ad49534293fd", "value": "391c3bc7f5534306976f645db21ff085.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd27dcd-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627384818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384818, "uuid": "ff6828d5-e60b-4187-9c0b-1f092ee2cacf", "comment": "Malware payload (AgentTesla)", "value": "60183d985a20da08edde84ad283fdb57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384818, "uuid": "fc6f389f-087e-47fc-8b06-5001b87a8d96", "comment": "Malware payload (AgentTesla)", "value": "0663ffc968c7a2870e7c3234b4c2c2c5bae705a12a1f84ff4527af8d8b9466e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384818, "uuid": "2cf2a808-a135-4f24-872a-0307fa98e749", "comment": "Malware payload (AgentTesla)", "value": "fa905171e489e10068ba2853fcf8c83865019283", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384818, "uuid": "515f53a6-0917-4333-a234-b3a7cb058295", "comment": "Malware payload (AgentTesla)", "value": "8efc169f5e9d891cd04f1a2c35138be969b75517cb49f12793e6ea8b0060174d92eda9be43502e28f71ea6821c59d23b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384818, "uuid": "036f356b-cd9d-467e-bad1-2c4789960ee1", "value": "T1B8053AA8F144649FD023C473C9B69C30F9A220BAD356CD07915F626B5E8F343896DE6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384818, "uuid": "e582e74b-e061-4195-8c95-c0ba9158e7b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384818, "uuid": "130f10a5-331d-439d-ac5e-e6eb41a8e638", "value": "12288:gjb/hCeQfNaK8RPWhdEFf+uHPxVXXQ3Oaf1HuqxNHxK+laHm6BmgCJtLYS7sK3Ex:ujseIanMdsmuU+a9ZXxrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384818, "uuid": "8318c80a-c6c2-4ec4-870b-92fbe908663d", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384818, "uuid": "cb70e6f6-119e-474c-8f58-ebf4925cb99f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384818, "uuid": "9b4bd760-933c-4cc0-b245-817e1b5359c2", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7844bb3c-eeac-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627371008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371008, "uuid": "83ed4ea3-7934-4c15-901f-8f994295dfb6", "comment": "Malware payload", "value": "cf207ceee98eaf713dd612a35fc042a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371008, "uuid": "31cd9593-28e8-4cdf-8660-e6c53abc6221", "comment": "Malware payload", "value": "069f9c7f2f9568bb8a2f800110e067e9429b415ef68a112abe5d813677601659", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371008, "uuid": "d331d819-38e3-41de-8d8e-20eabc90e8fc", "comment": "Malware payload", "value": "ae0c1e92c7d4b5179b203f40be2e687104c769e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371008, "uuid": "d38cb190-0042-435b-9824-5ea8d50fbf15", "comment": "Malware payload", "value": "0db112d63030e9a5b78bae41a83e17cedc56b940df6e784543adc9300bef2cc17ddaab968531901bdd3abf2b3115ffdb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371008, "uuid": "c90aa57c-02ac-4c87-b9a3-0dfbc68cfd4b", "value": "T1BE4250EB1B860377114342E9755CB6EDE376D1AC65A7A540B09AC03D0780EB5C73AECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371008, "uuid": "ccd56e7e-41cf-4d2c-931e-9d682e8e84b1", "value": "192:8sSFsffNHJv6sQAhJxIIHzO1chlsH8qswSuHiJ+IHzFsUsEsVsG:8sSFsf1HMs7bVH7hlscqswrHAHJsUsEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627371008, "uuid": "fab11433-543c-449a-b66a-be53b30a6682", "value": 12028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627371008, "uuid": "3210d2c1-7fed-4a2d-b13d-3009f3c14681", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371008, "uuid": "46efaf1a-7ce8-4f7b-9e14-4adffbf35368", "value": "theDialogSeriesAxes.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff893f58-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1627400870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400870, "uuid": "7ab14e5d-38b9-4675-8526-ececc1090090", "comment": "Malware payload (CryptBot)", "value": "3aa1f98b275f4e2d8febb9e4478c5524", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400870, "uuid": "0ecf9da7-4831-493b-86e2-d9d174d32662", "comment": "Malware payload (CryptBot)", "value": "07efd513a02e8c30296f7b73488d9a74796849787df14af028266cd79c89d51f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400870, "uuid": "357dec72-1f28-4942-9676-ca403496dbaf", "comment": "Malware payload (CryptBot)", "value": "112cdacb64629da494eee7cac8b3a7b606e78bfe", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400870, "uuid": "3008bd40-ae88-4205-bb42-e9d46146b666", "comment": "Malware payload (CryptBot)", "value": "46e671600ce4c6b81937217beab7b928cfcc9d91c185e7c6b55513cd6e0656413276fc39c3d91acd5f91045136587390", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400870, "uuid": "c66a61dd-9dd0-465e-8832-fff0eb4363c2", "value": "T1D4F4F12076A1C038E6F212F44575937CA93A7EB1AB3490CF52E12AEF56346E5EC31793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400870, "uuid": "1531da0d-4cd9-48f7-918b-b0c6309d0fb1", "value": "fbe702755e2fb4e20a84826fa92fd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400870, "uuid": "92e2b065-9c76-448e-ac1b-004da3582b47", "value": "12288:p3IfTxjJwJ0LWGJ3wY/Thl11QH/tWGFhbMSHOztQnKrG2mBBlf1eapqgt/aw:oxjJweaY/Thl1KlXrXKwBGaY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400870, "uuid": "f1fd2c2e-69f3-4d2d-b12e-7dafe413f3c3", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400870, "uuid": "fb59ca51-5d4a-45f4-9633-bdc876897181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400870, "uuid": "e7d06001-3b4e-44f2-a4cc-238fc11e0a06", "value": "3aa1f98b275f4e2d8febb9e4478c5524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25c311e-eed7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627389547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389547, "uuid": "d5ed6780-e9bd-4a53-8415-e6138cfb7d45", "comment": "Malware payload (Dridex)", "value": "1f196d875fd7d89ac57831926bbb9563", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389547, "uuid": "87883fe9-8026-45dc-b9a1-193e149043d0", "comment": "Malware payload (Dridex)", "value": "081618f7d9c6c92271f8d6bc65c8e13f33dfe9e5022f06aaec95664ee31fead4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389547, "uuid": "7349de65-d1d1-4f1f-ae20-84f28582cdf6", "comment": "Malware payload (Dridex)", "value": "3ed1e676f334ab3f82d3a056dad079f85458bfb4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389547, "uuid": "3a3196af-491a-4baa-9293-f2ea5b32ae2c", "comment": "Malware payload (Dridex)", "value": "b7665d248084fb7e4181a5cf036e326664bf27d0b08b8bc457b67a195a8a08e6c91b0e41e1428b832fce1ea2317c6c6d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389547, "uuid": "615e9a57-81d8-4e81-9d0e-8ab107fedc30", "value": "T144741289F172C59AFD4F21B67AD02FDB4B63382B86FC52B0E330256DC411F6A6E90116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389547, "uuid": "37760c35-85aa-410a-9351-1f05f5db2e0f", "value": "6144:2Lj+sWRo6tcJhv7Bzg+8h6F493OzNStilzFHVGYT7I3e2:2v+Zenzdl8OLzNSt0RzU3e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627389547, "uuid": "9bb8baf2-47ca-47a7-8b3d-0747e6cbc943", "value": 342797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627389547, "uuid": "3a703bbc-12fe-469b-be9b-c6cec83d2e82", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389547, "uuid": "b2a45d1c-8ae3-4666-bc17-213ede9801aa", "value": "SecuriteInfo.com.VB.Trojan.Valyria.5105.29893.19434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29aeb222-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627396646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396646, "uuid": "e84b7821-4fd7-4dc8-8021-3f2eb093c5f2", "comment": "Malware payload (AgentTesla)", "value": "518568b5c3bfcaa67474cd0b448c1dde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396646, "uuid": "86f7133a-dadb-4537-b519-2c1724506304", "comment": "Malware payload (AgentTesla)", "value": "0826832dd2b6d96d111d92f8917d86f7acd41abcfed19d9cea448b04b6b0dbeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396646, "uuid": "b603496a-7928-4ee5-a794-d5ae28af4a1b", "comment": "Malware payload (AgentTesla)", "value": "a72ca8d71e7a4424e6c54567bf74765ea92dbf4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396646, "uuid": "6c8ab495-11fb-40ee-85fc-0d98da8ca61a", "comment": "Malware payload (AgentTesla)", "value": "9735548af40e3a8e5f6fadb02daebcca7734ebf707a45cfab7e984cac24c7ff5d3096f77660d5ed3c4f2e899ee4d5879", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396646, "uuid": "9fe00438-4ad6-4904-8428-2d88b9ee957d", "value": "T11591E73857780C6BCE6690F0D578FE0608C7F26599C7299433BDFDF0172B3295A29952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396646, "uuid": "bbbbfada-6bcc-4076-b7b2-919dd3014845", "value": "96:WlKUXASMNT9hsgC16qIE0zcq3u5qq1/QJXU:WlKVNNT9m/0cqe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396646, "uuid": "ff41d9d0-ff36-4020-a0b4-9718beb19a51", "value": 4436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396646, "uuid": "7791100d-e9a4-44c2-bdac-38cc90d2e46b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396646, "uuid": "2b9a43d6-f84b-463b-aaf8-f5db799680bf", "value": "OKTAL PHARMACEUTICAL ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea4b60c-eedc-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627391554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391554, "uuid": "92c01c25-8415-497d-a12b-6264ce757163", "comment": "Malware payload (Formbook)", "value": "29645cb14447ff578aaa9dc4243f11e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391554, "uuid": "2bedc4a3-2e8d-40c2-8cb9-c9fd9b66e73c", "comment": "Malware payload (Formbook)", "value": "08893f139b09f2dc17635f17baf1f34d2fdf730ea44a41ba54b914ffc024f0c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391554, "uuid": "dead262b-ff7e-4a23-a65b-e3d1529cf54c", "comment": "Malware payload (Formbook)", "value": "cae1f1cfae48a35897e6c64b4f5b3de807af9aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391554, "uuid": "878075a4-c4d1-401c-9428-964319494f7d", "comment": "Malware payload (Formbook)", "value": "b9cb5a9751cd31af7877a66812c9ad4bbf4abb70de0ed1addf06d8dd76096868e9864c210119bc96af5428759df43489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391554, "uuid": "2b2894c2-9935-4930-99e8-fa62a14660b9", "value": "T1F3D459BC315075AFD633D873CA64AC10FEA024A7A307CE079153159B9E0E6479E4DEAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391554, "uuid": "0259defd-a34d-4f98-87d2-b76119f46cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391554, "uuid": "421783b6-f65d-4473-be1c-819de06d057c", "value": "12288:hbtxZV4rvssKZAysnyxnvaSk/eBKKkQF5A74PAUDS+ZEZa9EKRAsgwh31XBsjRJs:hb7SsbuyCyxvNLBJkQF5A7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627391554, "uuid": "14f4218f-2349-48fd-9570-e628503a6a53", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627391554, "uuid": "734ad8d8-bd8d-4afc-a816-2111facbdf85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391554, "uuid": "8ee49e8f-a48f-4c46-9a2c-2213d50935f1", "value": "Payment_invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ea8dc9-ef18-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627417601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417601, "uuid": "9fa9dd1b-db9c-4434-92d5-d431d60f55cf", "comment": "Malware payload", "value": "edc914278ecd1152eaf4a4f9cb028c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417601, "uuid": "b9e83551-1eb9-4b36-8cd5-3214027ce36a", "comment": "Malware payload", "value": "091cec318507f17135e70a5db930b9eaf373a4ab3ac181ec1e01ae8ac7a751b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417601, "uuid": "ea7584f5-cf9b-4527-8118-a04ab09c2370", "comment": "Malware payload", "value": "c061f8da5cace17f62b3050de0c177e53cf7a47e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417601, "uuid": "62ff9255-4f8c-4e78-85c4-40ca617133d5", "comment": "Malware payload", "value": "ae24ddac9fc97fd082a5c70fc8339f58d461c6484b7349c5f67a5ed2c06243ce486313c552ea4a15a89804b45d53bc87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417601, "uuid": "84185c76-6c2f-4219-a89a-ceb209517bb5", "value": "T16E9308637AB3F96BF0048231DC1395F4931EADA4ED000A17A5AC3E1D367E5C15CAEA9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417601, "uuid": "5768f70e-3739-4b2a-a14c-df3e9c30d641", "value": "e70a7f2b8db4a7173f4f6df944545375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417601, "uuid": "c64f2869-8127-4e89-9c3e-9b8eee9a1278", "value": "768:8b2EK/oFDpJiOdsdF9JNuUTPYQkACVfOC52hNortFwNUBhjjQ0gxlQeSg2nEQ:qK+2OdA/JHLYQpCY8BhjQ0u+3nEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627417601, "uuid": "39733290-b55d-40e9-a4b0-b1f8ff0f135c", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627417601, "uuid": "544b441a-acb8-4df1-8c57-b7d10301a318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417601, "uuid": "66440704-e2ae-4a71-bbcb-dd6b769d2e10", "value": "eurobank.pdf.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fc54fe-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1627399754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399754, "uuid": "9869893e-51b2-47e1-8785-74400b627651", "comment": "Malware payload (NanoCore)", "value": "820869d6bf485c32fd94fde70838b453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399754, "uuid": "8e95f2e2-79b2-4bfa-83d8-db80c162c78e", "comment": "Malware payload (NanoCore)", "value": "0971ed841b73f240346a0aac75acc3dd3ef1345420fba81b00b79366a2c8d6ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399754, "uuid": "9655be75-d054-47e7-ae09-a1b8a2d3e886", "comment": "Malware payload (NanoCore)", "value": "c387acae1c90dbfe7f5008516adcb510d2504ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399754, "uuid": "7137401b-3485-49ad-80c3-460e674246a9", "comment": "Malware payload (NanoCore)", "value": "31f7678c5ae8dfd66060cca7714e5b371d8c548fdda29c8c4f7cee07c599fa99cdcea3b41d80afff800ec8b66c1ecae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399754, "uuid": "a5c81852-7c53-46ca-aa80-71bb16d7a057", "value": "T104D423322F4B1EA6E87CDB3630496EE96FF08ED3564BC79CF989340EDD0AB195255900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399754, "uuid": "acdd7217-5e7d-4709-8c3d-f2c6ef25d51a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399754, "uuid": "d113096f-697e-4b08-bcc1-14d430da1d2e", "value": "12288:ziKH6p7O94pO0x8A9EQtc+XMktFEecK7Wvm8GB9K041U/hl4Do:dMDO6yB+1tP7SNGBcu/hll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399754, "uuid": "f50444d1-2117-43da-abac-78c68b3db24c", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399754, "uuid": "d19010e9-06a4-4c45-a4ad-0ff892873942", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399754, "uuid": "045e96c0-59f1-4eaa-a556-6fc6f5f2ac6b", "value": "820869d6bf485c32fd94fde70838b453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f660f2-eecb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627384538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384538, "uuid": "c0f81f6a-a214-48a4-a322-a7c2bd98f2aa", "comment": "Malware payload (Mirai)", "value": "2a141bb293d069d1202341b89a1a862e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384538, "uuid": "4d17ff6d-155d-4291-ac62-67979acaa5b4", "comment": "Malware payload (Mirai)", "value": "0a089902bd35af64ab8a909bb821cc75750e55457ca098d27ccf6f5bdd1affa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384538, "uuid": "1142621c-f742-428e-a715-2a2e182e21a5", "comment": "Malware payload (Mirai)", "value": "f07014d0c16cf72f9c249a261f5a7c632438b386", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384538, "uuid": "6057a130-7d42-4711-8ef9-7c4854d8ec46", "comment": "Malware payload (Mirai)", "value": "7058940bbcd323548dbfce4ab50db4b750b7031d02957915ea2a7207aa6e6a417fecf7aa406eb296f46d52252034210d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384538, "uuid": "4c64084e-c285-49d3-abbe-4635409538ba", "value": "T1D0232925B97A2D27C0D5603A66F34715BAEA131E31F8CB2EBC730F49BF1294062535B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384538, "uuid": "10428289-fd41-454c-9fd4-72410c9d1898", "value": "768:o+Cotlbpq9EjIlWw2MwkqnSWV2HJHMe3Ix8WmO+pzyQCt:oVcl9SEjIlW3M3IVv8XAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384538, "uuid": "154f793b-1cdc-4a75-8cef-1c2037fe9311", "value": 50060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384538, "uuid": "11cb559b-be90-4b60-afc7-035313fc0e92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384538, "uuid": "1d921c85-832e-4ab6-805f-345327d7ea1f", "value": "2a141bb293d069d1202341b89a1a862e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1c6fd4-eebf-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627379014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379014, "uuid": "4aa30c16-2693-4af4-aa05-e4691c256a2b", "comment": "Malware payload (Mirai)", "value": "5e36c74e601bfcdf641342c4c8f8ea72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379014, "uuid": "5504279f-f258-497f-b328-1a001f66b1fb", "comment": "Malware payload (Mirai)", "value": "0a297410ee9ed84def59b4b11bf869bc6231e6664829adbee456a76e2c2ffea7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379014, "uuid": "ad0e0fb1-2c33-457d-a341-bfdb56d39d29", "comment": "Malware payload (Mirai)", "value": "6212162872af488517e5351220d14c42e10e7a36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379014, "uuid": "bd9286cb-9daa-4367-9150-9d90abff5615", "comment": "Malware payload (Mirai)", "value": "8e71377389e7a7d2cb639388a4f1712cb8665bd4a24e1bf9d74cfe8ce1396db1370cb1c89e42e44148ef4734050f0642", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379014, "uuid": "d20e67e9-6d0b-4025-961a-7ded13bd3390", "value": "T12843614E2E318FFDFBAD863947B75E206259739526E0C284E16CED011EB030D645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379014, "uuid": "4f9ab6f9-3203-4cce-8db9-50744fdec273", "value": "1536:BKTGN1kVzk0UOSCtWL6Ze0pHT8k8tHKQ8:BKQSZptW0f8tHZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379014, "uuid": "e21e4edb-e2d4-4fb9-8af9-cc9d27375398", "value": 60516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379014, "uuid": "95fb81e1-098f-4c52-9e74-c84a717cb99e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379014, "uuid": "4bd8c8b8-d749-41ac-83e3-77d9ac3b3cb7", "value": "5e36c74e601bfcdf641342c4c8f8ea72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df30cc2-eedb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627391231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391231, "uuid": "7aa2917a-138e-476a-8b00-cb25d1bf7ce5", "comment": "Malware payload (AgentTesla)", "value": "8b0af96231dd7b5f99c1d51037dc0219", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391231, "uuid": "4bcc1f90-64aa-4c35-88d3-19e6f71b4541", "comment": "Malware payload (AgentTesla)", "value": "0a4331bb70c63296d2f975bad0903c1c9c539c1f9d349a187bfaf2633b3c06e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391231, "uuid": "3cd77351-211b-4b18-bc2d-080bca6a0382", "comment": "Malware payload (AgentTesla)", "value": "44e2961033d6dcf08c9eec519d4aba1f3f786f2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391231, "uuid": "4fc52981-d3fe-43eb-934c-2a363e0c056b", "comment": "Malware payload (AgentTesla)", "value": "3d960ea1ba54f2f5ad70e0de765fce53623bddecfea0b697e036fbb20af88bf2deff1813416f1444d73f426a268b8075", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391231, "uuid": "982422d4-9f22-426f-992c-2f9724add6d1", "value": "T15BE4BEF93539375FF493847E54B05CA2695060FACA2EC792F32341ABEF1C48BA940697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391231, "uuid": "6fd06f22-b42d-4a07-9ac6-a253edf23106", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391231, "uuid": "ad4292a3-8d5b-4ff6-9008-cc4e25005b95", "value": "12288:ZWkDWpXtKYqYXyWUeYobOkR/RaK6ctthNEEm7sUSAav8RSYJp7bHa1prG7mo5oFY:ZWkDWGJYXtCER5aK5GpjDRSYz7mo5oFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627391231, "uuid": "6587b524-29a9-4d00-af82-532dda6cfaf3", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627391231, "uuid": "67c76494-5f04-4768-95b3-12e2e841f3f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391231, "uuid": "e9219eec-63b1-4df3-b83a-bcbca5bcf15c", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2c3bf6-eefd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627405856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405856, "uuid": "99f953b0-577a-4414-8945-2f3a149885b3", "comment": "Malware payload (Loki)", "value": "24223b041b509d6c1beeb95476ab369e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405856, "uuid": "153621ac-c3e5-46ec-aad5-ab9af42330f1", "comment": "Malware payload (Loki)", "value": "0b001d661533c36d7db5da32627316733b1c1c8d7ac74b11f43864382d560a17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405856, "uuid": "b07072d0-265e-4521-8b70-f7f122dd4f9a", "comment": "Malware payload (Loki)", "value": "de67ffc5599f5313396604747936b37fdc8b9c07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405856, "uuid": "29c31986-c514-4fa7-abf4-68dba6f74e32", "comment": "Malware payload (Loki)", "value": "17e9776deb1a9f965f52af7fbce8af19e1189bfd1af7fac3b6533d4fa4a996088f34394c8087cc9245a59725f865c4a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405856, "uuid": "e5f05d64-d779-44c8-bd4c-57dced4d835f", "value": "T1A9649D20A751C039E5F211F84ABA93BCA5393AB09B3450CF53E5EAEE16346E1EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405856, "uuid": "9f0cb772-a897-4aab-bb11-6f5574dbfbfb", "value": "800102d28cf35c665bee356e0e434ad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405856, "uuid": "807fcabe-a732-480c-baa9-0214db8180c7", "value": "6144:dC872uzffrrVKyxDVsKGf/kHSazDXgfH5rSxis8W+SYfXxFHUqD5oT:v2YffvrxDyK4kHNXQHdff//xZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627405856, "uuid": "9c8b29d4-c971-4f09-a360-0a9cdbab1b05", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627405856, "uuid": "090baf4b-f7a0-4551-bc83-080b57c681c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405856, "uuid": "004a1116-a3d7-40f9-bb73-7fb2ee3beab4", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1865dcd-eee7-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1627396417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396417, "uuid": "03aa94b3-b912-4e6d-896f-054895663d33", "comment": "Malware payload (RemcosRAT)", "value": "34684b3de7b33bb0bc8e9b8e62a26431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396417, "uuid": "012f1b4d-4a3a-40fe-bc3f-383850d56746", "comment": "Malware payload (RemcosRAT)", "value": "0b10f51931ebadefe515c5db78b89095df9ff47ad1bd042eace9d47047c5a09d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396417, "uuid": "32d830fc-0f70-4402-b46a-d528e0f37f64", "comment": "Malware payload (RemcosRAT)", "value": "c4ad20e82a7456c4bea6436c7a394deed5fa4e8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396417, "uuid": "9326a992-3f02-4446-a6a5-23098b04f020", "comment": "Malware payload (RemcosRAT)", "value": "2a4615aaaee470dfb08f2bea4ed462ce6b603f1469733a9b2ac6d684418a092ce55532289b682e0cfa29426c41c12014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396417, "uuid": "26a1cfa4-6746-49f5-9762-0f43ec662bee", "value": "T1D7059E31BA515936D53629799C07E3B8A639FD102E18AA433BFCD93C4FB534279281CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396417, "uuid": "419e9d13-799d-43e0-98e6-49ff746e9340", "value": "c76515f33c28ab06b1b9a160bab156ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396417, "uuid": "ecacf33e-3895-4c41-8184-043a24c6f9b1", "value": "12288:Pk7JfNhjmkfdkN9ogGWRmYcGT8+275o2xaUGmj1a05q+KgTJ28BDGQPN+BRKa:mdXmkaN71RmYcN+MVxauj1fQn4cSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396417, "uuid": "f4ae2a0f-3c43-401d-aec7-16af98db76ea", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396417, "uuid": "1c09f6de-0685-4a3b-8271-dbf9b5139f08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396417, "uuid": "53ba978d-56d0-4823-9914-7c2913a92542", "value": "Dringende Vertragsbestellung GH7856648,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1d8ac8-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627366293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366293, "uuid": "bf64d87c-a719-4572-b83d-d724e5100729", "comment": "Malware payload (AgentTesla)", "value": "2c688cbecffc0a28e2ba5a30a1bdfd01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366293, "uuid": "5f272c88-de69-4b98-933f-17106a06358b", "comment": "Malware payload (AgentTesla)", "value": "0bb7ce952f7357a61b26a358f520f14b742625dca3b6214bba6f85da18caa200", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366293, "uuid": "542c8ee7-f86e-4770-b2d2-c7312b5a1018", "comment": "Malware payload (AgentTesla)", "value": "53ce765143092d7c2cd23c9e0391abaf45ca3ef4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366293, "uuid": "51f2a2f0-52f4-483b-8c4d-3daa5c208966", "comment": "Malware payload (AgentTesla)", "value": "3d0a6c684e75c96e94216d839ea646ae4e5f3fc886f4bba8aeb0387fb34e2cc4373ad3c3bb7d3da785e0f933c05b7ece", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366293, "uuid": "53d579ab-2965-49af-a642-96f76a0f7c85", "value": "T1C1F4CFE4162C7F1FF06F0B7D907140625BF0589BDA69CBD5FF3224EAAF362A65011286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366293, "uuid": "dee1f57f-92bf-4958-a8f0-2963c961fa6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366293, "uuid": "52829209-74c6-49fe-8c74-3ccf9e3c7eaf", "value": "24576:sSyC3OsBgo0q4wMxevautLq6A1eK/gf68KZ:sSy5oHMfCun/gf/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366293, "uuid": "37d01815-a179-4cd9-a2eb-ac9c0829edff", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366293, "uuid": "3323a93a-1fcd-46ac-a4f3-89b8f7ef68ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366293, "uuid": "1620a03c-bb73-4a13-9e0a-cf1d5dc4758e", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152961d3-ef18-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627417227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417227, "uuid": "28cb52fe-266f-42c4-81ae-56f9dd0825cf", "comment": "Malware payload", "value": "3fae6d64257ab2ca526d3dc2f95112ce", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417227, "uuid": "31f26212-2a08-4d4f-b42f-6462a72ff721", "comment": "Malware payload", "value": "0c0844b505753daea5f39249017ee053f50d3024ef5ac0e8e10bc2661d3a9054", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417227, "uuid": "462e291e-7eb6-4bdd-911a-3a776ff7b1e9", "comment": "Malware payload", "value": "40dfd8f0d0508192bfadf6404572555a564b0409", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417227, "uuid": "3349fbef-2b3a-4fc7-9636-4a44144fa229", "comment": "Malware payload", "value": "59f87658275f986133ac6e045449d4595e2c10dafbaefe015015634de3460905e212f9bf360291561d422a573037bf18", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417227, "uuid": "4f265d08-a468-46eb-ba09-169acc1c9add", "value": "T16B84231C2100A61EDE746A76B0EAF3F605810B6767958092EC34D76BF32391E9FEC45A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417227, "uuid": "37a7ae49-6c3d-4d15-854f-a775b1c56d4a", "value": "12288:Nl8zzlSw4tmznozmwdZd0nVJbhcTLO8lCz:7Jt0nmmwdZOVJbcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627417227, "uuid": "075d59ba-fdf3-4884-86fc-7922b94f327b", "value": 398481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627417227, "uuid": "bd76dded-27dd-44cb-8384-5e1bf6b9541a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417227, "uuid": "52a9f985-b34d-4030-91ca-a6d61b9e1442", "value": "\u201c\u4e09\u660e\u5e02\u201d\u5973\u83dc\u519c\u5728\u7f05\u56e0\u79bb\u804c\u88ab\u9ad8\u5c42\u6027\u8650\u5f85\u81f4\u6b7b\u201c\u89c6\u9891\u201d\u66dd\u5149.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f378520f-ef20-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627421036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627421036, "uuid": "e91f7df7-2571-489b-9093-531ffef85203", "comment": "Malware payload", "value": "13d2947bf6c6870f9ad0bef3f7dcc43f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627421036, "uuid": "0d7d25c7-b690-42a0-bbf8-b45fa136070a", "comment": "Malware payload", "value": "0c8b9ba8bdd9a1d91ba4d61c81480b7337e6189fb0836301d71e90fa6adec8b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627421036, "uuid": "b3a91407-617d-4870-bff3-0d7d567c6c08", "comment": "Malware payload", "value": "888f478a75ca41fceb86233083c047b0621a0d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627421036, "uuid": "9578d9b6-9643-4282-871d-a931e091b219", "comment": "Malware payload", "value": "32e9ecc1606217ba8731d66db0920f0236cd4ae97e68477e43493705da2a9705ac84b477f76fb10cf6bc9da4e58bcd72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627421036, "uuid": "2207f078-a1dc-4683-83e1-32c79a51cd94", "value": "T14D936A6230B7FE61C5991130C0ABC9F66E0DAD27DE15AB23294C3FA83970692957FD1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627421036, "uuid": "6ea7a038-46e8-4e37-85d7-516df9e80404", "value": "8d57d2d3c907346d55c5c636fc76579b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627421036, "uuid": "aad52dae-63bd-4335-9dfa-f73541eec693", "value": "1536:01BRMipLydPifEOpWhmDDQC0Q8spPjDN9lIsapn6nQVOjoe:KHFydPilW4gCNvI1sjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627421036, "uuid": "1d2b6a81-aab5-432a-a7f4-63628ef7ccd3", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627421036, "uuid": "897fb741-a26b-495d-a057-618031d80ef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627421036, "uuid": "f5a9b0d6-a3d5-47ae-a5f0-9c5d4c8f9e37", "value": "Dolmas.xlsm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb165ce2-ef11-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627414580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414580, "uuid": "992d8d6c-89b2-4b62-acf5-f21483c2c6d7", "comment": "Malware payload", "value": "db9f1e135f53e1eeb3fc32b4a933b520", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414580, "uuid": "69116b9b-58c2-4b37-8a85-439884c05b92", "comment": "Malware payload", "value": "0db7b81b015fef583d700e0c9f444db8a90e2f663e63914e3e9c1122a0c56088", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414580, "uuid": "5e4e6afb-7144-47d0-882a-e4be1d40719a", "comment": "Malware payload", "value": "4017b6280240a05b73fdf7252613d3e757907c32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414580, "uuid": "1c92e03e-ad37-42fb-8804-c5a512e804b2", "comment": "Malware payload", "value": "a734a19d2a91171d3dff0e8310462644fbc03b21dcc010474e90cb84f0da9bac9aae30c1f7ff7f1320f588a7e2271cd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414580, "uuid": "04bfc598-3cbb-4352-83e5-7b7d95b48d1f", "value": "T108735C34A97E2F26C0C4A17E52F78750B2E5220F2AB4965D7CB20F4FFF24544A8562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414580, "uuid": "c65cce82-46a8-4465-b3cf-89052f795a7a", "value": "1536:vsnCSemCLLWeKNJ+1kbOSYcpC636v/bcYSZAFFi:rS1+SYccv/gpai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414580, "uuid": "79af8d82-a433-442c-b90d-605cac4bbc00", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414580, "uuid": "bfc12832-5861-4360-abaa-4c0a1a38481f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414580, "uuid": "233a1773-7e4e-4367-b558-a2898b82c155", "value": "db9f1e135f53e1eeb3fc32b4a933b520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101e8764-eea7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627368686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368686, "uuid": "bc83c0b5-dad4-4388-874c-5ddd36de5777", "comment": "Malware payload", "value": "cc1f21c18c367979386fedc3fc8d047c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368686, "uuid": "86a9f31c-b825-4dc6-bae8-f72d8110d0dc", "comment": "Malware payload", "value": "0e45ca26c0dc7ff5b58561f0519f611ede375773b2570e5eca4ada274dbecd6c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368686, "uuid": "282efe5e-f76c-4f9b-a435-660e65bf8ddd", "comment": "Malware payload", "value": "a231f398d370d20cea409115ece0955299c9ac40", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368686, "uuid": "8f04c4fe-4326-49d2-ab96-3e8f4c3a86ab", "comment": "Malware payload", "value": "3a9f44d07e9ab00fc448ef048a63e23ce903c3670324c2741d783369d83f5a237b2b64862c531b449ca574e5a7b0f9ca", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368686, "uuid": "ecadcf1a-a21a-4515-b54b-3622e0efa1d7", "value": "T111F5D8F46D319958B4896997FAC0AC8500C33CA876AF9F5C4214BF7B34A3594DBC898F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368686, "uuid": "0eecc058-872b-4208-bf5c-272d480bead7", "value": "1536:9zmbPc6jAqP3NUUSNh8Fr1Gy9Ii+VHm091syuaVixXTipqGoCrshhkLVcl1D2USA:9zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627368686, "uuid": "207558a4-3fb5-44a7-8d00-fea023079a2c", "value": 3546477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627368686, "uuid": "2fe5773d-8997-4180-9e6d-5caf5e061248", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368686, "uuid": "3f74ec5e-4e5b-43ea-91dd-1ee8816a2437", "value": "Waybill Document.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f56865-ef1f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627420603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420603, "uuid": "f2761667-0f2a-42c4-a291-56299af970e7", "comment": "Malware payload", "value": "38e13fcd219f49d7cca9c8be57ac6ef0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420603, "uuid": "49551f2e-55a2-49ef-9312-01b6ca05d739", "comment": "Malware payload", "value": "0ed4dcb3b64eb9b43a02b433a6232b64196bf369c3b2c50ce5342c8e9f4fdcd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420603, "uuid": "1f62c31e-ddbd-4db4-8b98-cb8c4cec8155", "comment": "Malware payload", "value": "637a26e5e069a3262511666304aa07fb3c8cba00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420603, "uuid": "c6274cea-cd09-471a-8159-16e6f799a2f3", "comment": "Malware payload", "value": "ab9a5af48842f4420d68f1e7492126c27c22f3f10c23667c826939e981df4c1cf57b11e29fd3502307ada8777aa457ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420603, "uuid": "acc46d91-7fa6-42dc-b744-a1f56de57c10", "value": "T15A358C10236B4F98FC7EAB7A6438400457F5B80BD32ADA0D7DF610DD1691F968AB2B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420603, "uuid": "31926655-555e-4f1a-b3a2-da6e2c2edbc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420603, "uuid": "5afa47d5-5622-4e6d-bbbf-e6a33a632f95", "value": "12288:afZnQu/MpIIMlcNn8YOgTB6RyvUIZbVRDIG+MU0js05zDYqzLJnkkYprTH6S8GZj:VkcNn8YDEsvDBRDw0jsWYqzVfIX8sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627420603, "uuid": "9dff33da-919e-4ffe-aa0c-4796d784208d", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627420603, "uuid": "c5a4b187-987c-4e39-a8b3-93cf07426bc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420603, "uuid": "ba65b68b-2a0e-49de-9804-1889377d6570", "value": "Copia de pago jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b93479-eeed-11eb-875b-42010a9c0053", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1627398763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398763, "uuid": "c0ddcb76-f06c-489d-b99c-b8a3bbe3b24e", "comment": "Malware payload (RevCodeRAT)", "value": "08f2609e7f7daf0f78032f773a68b72c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398763, "uuid": "c84503d8-351e-4bc7-9c6e-b406d7095e99", "comment": "Malware payload (RevCodeRAT)", "value": "0ed8f93b98f9cfff89559df9e0a8d360cab3dde1abfa2992216b4a98c5ca1253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398763, "uuid": "0cec744d-29cd-40cf-aec9-978ae776673e", "comment": "Malware payload (RevCodeRAT)", "value": "f00e4c61cce15ee5f43c032d8d595aba65fbdc86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398763, "uuid": "c4b93a88-c866-4b51-9605-d47ddfb7f75e", "comment": "Malware payload (RevCodeRAT)", "value": "3e85faa2be9e5fb21cdd553f8e8105cd85400dfb134c1b00ec367b5ea2aaa67492cc160d2e6a09f9f05229c28ad77a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398763, "uuid": "81d4c11d-65f5-44b2-91ae-e41d81177efd", "value": "T10165F0F005397F0BF4AF0B7DA0314062ABF440DBCA69DBE5FF6204E7AF652962065646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398763, "uuid": "3847c3e0-61bb-42a2-be06-c287a0b58b55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398763, "uuid": "22f5894c-5c87-4b80-89a0-4498ee82f685", "value": "24576:abOd/OsBgo0q4wMf/5vUQgxZGCc+b8QHsDpXgbkyh1Sl+inzQSjzVrV9ZtXCU8jt:abOsoHMXpUnxZGClb8QGryPSEY79/CUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627398763, "uuid": "c42b6de1-9847-4897-bcd4-ba703def13e1", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627398763, "uuid": "88efdfb8-4418-41ea-b41c-ded2eb590492", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398763, "uuid": "dd086604-1fb0-4136-a78f-32bb192c17fe", "value": "HSBC_PAYMENT_COPY.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce84ee93-eee7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627396493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396493, "uuid": "9ab495fa-a3c0-4b58-a913-0bd26fbdd37b", "comment": "Malware payload (Mirai)", "value": "1bebf9bad22075780c27c933485a0844", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396493, "uuid": "fbee653f-8cb1-4e4d-a4b4-634a68901ced", "comment": "Malware payload (Mirai)", "value": "0ee394f0735ee379827c37ee1f043480dd31db87a32385265f64b4c710f05f11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396493, "uuid": "ab1856c5-4996-4801-883d-d820f3bcc30b", "comment": "Malware payload (Mirai)", "value": "c7a99397903bee6ddebeaa8039ac0d3749761998", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396493, "uuid": "95927696-b3d7-46c1-8f77-e0647be88c47", "comment": "Malware payload (Mirai)", "value": "3f027b6d9438f25c135403a56a244608d8e0754a44a95ef17e0de3be0ca9fc6cb055ce68842869d1f6979758eabaf3a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396493, "uuid": "4952c474-b701-4463-a766-37b424d93c6f", "value": "T13453084AFD81AB11D4D926BAFE1E024D3313676CE3EE72029D206F2577CA91B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396493, "uuid": "bda188a3-0cb8-4896-b17a-b5b3074bcee7", "value": "1536:YxnywJV+kMGMlYvHRl+MUZN4xijHgvQlB9l20i7Cu8wxsH:MJ+GHMMHxijHgvd1CHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396493, "uuid": "b5d9defb-a4a3-4371-8f23-c7eccccd1d64", "value": 65180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396493, "uuid": "70eb54ce-e092-440b-aa52-9996bcbea93d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396493, "uuid": "55155387-eea1-4075-84d7-80b1c837a28e", "value": "1bebf9bad22075780c27c933485a0844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d89e61-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627372099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372099, "uuid": "83c9c3b4-73c1-4760-a9bb-9ca148ecba96", "comment": "Malware payload (Dridex)", "value": "ebdfd39f4b9ab189cd32b271db4bb3ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372099, "uuid": "9278f787-6845-47c0-a7a6-4857656163f2", "comment": "Malware payload (Dridex)", "value": "0f52e85eae79fb03bd9b391bc9753417cd066990a41251d385f55e2c9c7b4b53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372099, "uuid": "5f4d080c-5761-401b-a34a-e4f7d54cfe57", "comment": "Malware payload (Dridex)", "value": "839ca7bf434c05541e2df56e1eab0819a5822b1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372099, "uuid": "99fb47cd-a29e-432d-a7d2-c258bb6c8f56", "comment": "Malware payload (Dridex)", "value": "b6fdb55af18281cc191bef801dcc5724171d0cd78ef26b5594e6f038b4e436d808e17ec849152be06d769e28dc36ca92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372099, "uuid": "9725ac96-7968-45e8-a9bd-49e2ddfd8142", "value": "T13204CF51D2DF2AD9C41E87BC11947A0976B07EC2CB68C078E266C4BCEF7BD4649E4326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372099, "uuid": "c0987fda-a758-4516-b560-8ec82ac86dba", "value": "038ee71bd4ea63acaf586d3475ef17a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372099, "uuid": "871193e9-1ed5-4856-99f3-333b2fe8b713", "value": "3072:wXY5bY8XE+kkqh84cKcv4FinaLzL2rVQLOmpvNbTAvestOr18T:+RAkkk84e4wne2nmhFAve4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372099, "uuid": "5362c4be-77ea-470c-adff-8e1a76f70f2d", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372099, "uuid": "6668bb55-0a34-4d60-aeb3-4bb0c7e4c798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372099, "uuid": "74cdada6-6bb3-44b5-9018-cf86a331168b", "value": "hsy_utu8_12u_v4.4.7.0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95b7baf-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627396887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396887, "uuid": "87dd8626-e41c-48d8-abba-1c5515d89698", "comment": "Malware payload (Loki)", "value": "7c13958c9636c3b2542a71d3eacf93b9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396887, "uuid": "64bdf062-91f9-4a48-a105-19633a6852bd", "comment": "Malware payload (Loki)", "value": "0f77e014b10cc25d53aeb14e1eff9271f9b7f16aca4c196fc082dd3207191b28", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396887, "uuid": "b8ffb903-205a-402e-8a54-f3dc24fc2e8e", "comment": "Malware payload (Loki)", "value": "61bab72e6b532ef51cfd36e7836c97b992e62fce", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396887, "uuid": "539d9812-7b39-4e7c-a5af-9d0e7ca8d709", "comment": "Malware payload (Loki)", "value": "267b5e524b89bc37a85b31e7de91c5b916173515951bc5e0167e95773131aa800fd57b4d72035ba9add70d6f53f7c51f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396887, "uuid": "8086306c-cd6e-4686-bb95-3c71a170b084", "value": "T1B54512827EC89776DAB306FEB686FAD4471ACC1839FA10033C1673257231D27A5D6768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396887, "uuid": "bb0206b5-da38-496c-b8f9-03f25d207102", "value": "24576:Yhb+NNm4ZAjfYpOyw0ChTKOy8DAYVVVMMS+9fdZCoocf:YhbkMXf+2Tdy8D3R79fbCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396887, "uuid": "ed9d6880-53b2-43a6-9f3f-6d428d16f3aa", "value": 1233920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396887, "uuid": "c1bfec6d-d8f1-4601-b41b-0eff4750dd3b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396887, "uuid": "c7154008-8e89-48dc-b56e-75996f5e4dca", "value": "MT103 101T000000018.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce6c472-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627400758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400758, "uuid": "d93135a2-1708-4a88-bf9b-ced4797bfbe2", "comment": "Malware payload (AgentTesla)", "value": "56a49812b0b2214950f241aeec86fa55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400758, "uuid": "dfb31a13-ee03-49b6-b270-a6df66e7ed44", "comment": "Malware payload (AgentTesla)", "value": "0fba63de28c93fd00593e1b906f7a78e197d3392ed24fc4e4d24c8405d11bab7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400758, "uuid": "1de4e2d6-fe38-4297-9187-d9fbf4c84572", "comment": "Malware payload (AgentTesla)", "value": "c33b64a409a9fdb32555e14ef57290afa3942710", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400758, "uuid": "2927d35d-8230-4503-97a8-af6b8530c1e8", "comment": "Malware payload (AgentTesla)", "value": "b726906cf98b9bb368d853386d8a0a6a30f7efbd32c6ec6f30cdd8dd8d8d8d91ecd0dfddba2a75f8bd2ec09d57c6a53b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400758, "uuid": "dc1b0ffb-7d75-4102-8d38-d7c69c773071", "value": "T108F4DF39645099AFC632E133C628EB04FEF259627232CD0A439BD6874F0B543699EF5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400758, "uuid": "e19f6993-5895-4518-8436-5ac32051ebb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400758, "uuid": "a55f2e2c-09ca-478a-bea7-337ea351960d", "value": "12288:ex1irUk42WMA2Wc0wtY+Y/Ksd4Z0Sgmvzv6X083:eTikhMmT+Y/KTZFgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400758, "uuid": "20165eff-9bcb-45a2-9d84-d772112b9841", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400758, "uuid": "e56a6b0d-7f29-484c-8dc0-e00732bf91d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400758, "uuid": "8c250ce6-4125-443e-8732-1f0bf7f3aaaa", "value": "SWIFT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44f1a69-eede-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627392610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392610, "uuid": "c0792b6b-69c2-4529-b8c0-2391174ed5b1", "comment": "Malware payload (SnakeKeylogger)", "value": "e9054f4014dfecd8d77edd15779b91ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392610, "uuid": "5134fc9a-c9a0-4028-b054-ff90e023770d", "comment": "Malware payload (SnakeKeylogger)", "value": "111549fba23f6124b48a1cefe288eac3f35d2ef71cdef03e806283dfcc66b6a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392610, "uuid": "6cd0cc7a-7a47-42b5-b15a-84161dc28ab4", "comment": "Malware payload (SnakeKeylogger)", "value": "cc964b02c712a3164a03c11a4713bb3f0d302fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392610, "uuid": "86e1cfb1-5f66-40c8-9911-f2e4ccb75a0e", "comment": "Malware payload (SnakeKeylogger)", "value": "ac21a6096d0e0fff2851043a68e7d2382809c3faedbd7e9c240ed667e88662ae7f0c7d8b1cd387cb4d871c756907375d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392610, "uuid": "09ebff43-45cf-4620-9f89-d1a58a6984a4", "value": "T173C3181D6BF89C10F5FF8A3702B11125C7B9BD82096BCE0D0AD1F469193E6A09D49FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392610, "uuid": "9520d4a4-2906-4cf5-aad0-9316dbbfd1b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392610, "uuid": "8ca39eb3-4df6-4b26-b1d9-8ba34b6aba23", "value": "1536:EtI36AfnDXXRlzdX9y0XSj3fKDblewdS6Opzfb/an8NFL9KpiOWBBcC:EtWXZ9yESj3fKDblFSDxbSi98wBBcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627392610, "uuid": "48a4ecb3-efee-4401-a408-95bb0749fb25", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627392610, "uuid": "d16e227c-0ebc-4d16-84eb-fd6f16149ac0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392610, "uuid": "f21b2efe-fb7b-4f63-92c4-f5cbb29c35fc", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858224b7-ee6f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627344831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344831, "uuid": "64c594c0-de2e-4b29-87b3-d368da632cd8", "comment": "Malware payload", "value": "3562f4097d15b565023e907db414fddc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344831, "uuid": "0f50f114-db3a-4b4e-a989-422380f89c3b", "comment": "Malware payload", "value": "1203f64549dda9ab00a7591efa9c363ce01f8d4c096e8b45a8ba699fe62bbb6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344831, "uuid": "0b4c3a04-cc0e-4132-a30e-439c7423c521", "comment": "Malware payload", "value": "d345ee9eebb262bfd060e646990188e8f6c2fdf2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344831, "uuid": "6ea21e0d-b4e5-4037-addd-19142810fd6d", "comment": "Malware payload", "value": "956222e0be95bf1c999b71fc807869b575700dec81848f024afbff73dccfc39672868748955dbb6c873776655537e031", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627344831, "uuid": "f271cbae-302e-46ad-8675-4b8120111e33", "value": "T1DAE4F158F5AE8A67D94A60B200530AE66F56DEDF4FB4800357D5360CE0BDE246AF12FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627344831, "uuid": "b0044c88-72df-47c8-8506-bd6e3d8e140d", "value": "12288:7hWmhex45rHKnS50KagWqtwDBhLRAv2nDGq3xmheEARAv2nDRq:d/hKs0KMHfAv2nDGq3UUAv2nDRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627344831, "uuid": "489de83a-66ca-44be-aa24-e8f937ae80ef", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627344831, "uuid": "b7110424-e7fb-4158-9ad8-e511d9380fca", "value": "application/x-hwp", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627344831, "uuid": "38c638e7-cd3d-4aae-b917-a29739bbfddc", "value": "\ud22c\uae30 \ub300 \uc815\ucc45\uc2e4\ud328 (1).hwp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03db22d-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1627375826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375826, "uuid": "b6d6637b-e847-4521-902d-188c88ae6968", "comment": "Malware payload (AZORult)", "value": "82be3b738b7b375f53a4bef3a37e4585", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375826, "uuid": "2eafecc6-8aba-44e9-8e23-b3f2bec90467", "comment": "Malware payload (AZORult)", "value": "120fcd098c502894515feb3814bd6edc34ceb13648dcfae2a22c4f4e2166ace2", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375826, "uuid": "8aa78d3d-093e-40be-9665-043297fb0337", "comment": "Malware payload (AZORult)", "value": "417c1f005b106dbf326614ba4ac9c41c83abb267", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375826, "uuid": "bce43074-bbeb-4cd8-8a36-b146966f2087", "comment": "Malware payload (AZORult)", "value": "ab82d30e31c6ca969ae703bef692fe5fe421d5ecf76d97b49fa8eb0f96cd629a7d4e6ece5b0c72e2c3c2f202e03cceeb", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375826, "uuid": "093ead35-140f-4cce-a8f9-10a6b6b4ec4b", "value": "T17A947C0933A2EF7FC01217B3EAD753692231DEF51747928252863F891E4A7B46F481B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375826, "uuid": "40ad95cd-b6aa-4383-b160-2214a3f847a7", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375826, "uuid": "826c2ca0-b3fe-4d5b-b7c8-039c903450ca", "value": "12288:Xd53TvpHeIl0MoX8t0CPARBp0xm0ltBBm1ccBFJL6:Xd53TvpHeIl058CoART0w0ltBBecOL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375826, "uuid": "9f6e1a2b-0950-449d-8f0d-b891c92afda7", "value": 435324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375826, "uuid": "c3c4a696-c2f1-4ab2-af3b-25195160b8d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375826, "uuid": "73d44ab1-c94b-44fa-98ee-27ee456e48b9", "value": "Order 27.07.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776ddae9-ef27-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627423835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423835, "uuid": "2b2977f7-b943-4ad4-84e6-67444f8508a1", "comment": "Malware payload", "value": "9dccc5208f679e34fb3b7090cbbe287f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423835, "uuid": "8643b833-9da8-40a1-95b6-20c5a775998c", "comment": "Malware payload", "value": "125fdf108dc1ad6f572cbdde74b0c7fa938a9adce0cc80cb5ce00f1c030b0c93", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423835, "uuid": "0fe3c3fc-1f90-4086-84a7-b2d47b1fef06", "comment": "Malware payload", "value": "3a0f67998ff0cf940acabe82ee85974da9e00ebc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423835, "uuid": "3518b098-174c-4c5e-b291-d684e7209451", "comment": "Malware payload", "value": "4a18655a684ce827fa8efe6230e32c19da9e81d37d3b8f37d0e4d314b84019ac88e28464e7dd313362d527ff49f97be1", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423835, "uuid": "e6fb4028-ce9c-4228-bca2-a00929f47f64", "value": "T188637D2177D59470E5FF063518B48A41267E7E219EF68C6B3F84128E8A702D0AF79F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423835, "uuid": "561f6917-3374-43c3-8ee0-cfc5c8fb8649", "value": "04806a1eaf4e8de6f0935e3aabe9b8bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423835, "uuid": "f0631e78-0eb2-43e5-90ae-63e1428db9e0", "value": "1536:04Hd4iaPI1/zhAP6YtnogaDc8zvsWjcdSB8a:uzw1/zeMzQSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627423835, "uuid": "10fcb616-ce4d-4fc2-88cc-c40ac854d24f", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627423835, "uuid": "ea740f56-e645-470b-839e-7f0c195604e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423835, "uuid": "2b83d5fb-5f87-48a1-9506-4e4a19d7433a", "value": "125fdf108dc1ad6f572cbdde74b0c7fa938a9adce0cc80cb5ce00f1c030b0c93.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a926338d-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627400725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400725, "uuid": "1de41ed4-dd1b-4c65-82f3-64debeeab93a", "comment": "Malware payload", "value": "8d88e6c50bcdd9d5e4ecbff089e0e3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400725, "uuid": "2db58bdc-b04f-445d-a1ca-cafd9311cdd3", "comment": "Malware payload", "value": "126221d30da453634db4953147bfe32b5fd1e1af4187bb425d3714b7f529ecdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400725, "uuid": "708f3558-2d9b-4647-ace8-195cbb5728dc", "comment": "Malware payload", "value": "78994b2596f687a4e64e39d92a93b7acd2cbb534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400725, "uuid": "319ea89e-289c-4be4-9759-ee9a46c37b2b", "comment": "Malware payload", "value": "4b563e941b21b7c2fa9f29ad9bb2cca4eba4e66c66b0b3aec6af9504654c3e838df78a0936b9085adfa55b3037eb824e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400725, "uuid": "3c94ba66-24c2-4a9f-b2c1-3da0a7ddc50b", "value": "T197F5336137B6DC26EA79067486BBD9F6B624BEC92C20A30367557387B5334035E49FC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400725, "uuid": "eaa7304e-08bd-4299-aee2-915f45f320aa", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400725, "uuid": "92be335d-e41d-452f-84c8-e5e2ffc89d4f", "value": "98304:8vjUSaq4yh/jxV/sU9foEMWfwapxIJ64MNxvvr7:8Y9mjxVUU9Mowap6hMxvj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400725, "uuid": "725e914e-005f-4301-ae26-55dbc36b9a4e", "value": 3322891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400725, "uuid": "c0d06d2c-467a-44bd-a5c3-029cab470b2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400725, "uuid": "48fa5cda-93d5-48f5-9b8c-c452305cfde2", "value": "8d88e6c50bcdd9d5e4ecbff089e0e3e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aedb1b2-eec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627382179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382179, "uuid": "58bc2faa-359b-4392-af53-9db240500a90", "comment": "Malware payload (Loki)", "value": "fce02d5ae70e73ef9e8d23fbc58c4796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382179, "uuid": "b96f4a9b-18da-40bd-a98f-54aa65b1fe0f", "comment": "Malware payload (Loki)", "value": "1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382179, "uuid": "099ffe7c-07ad-4d24-b376-98968eb7ff80", "comment": "Malware payload (Loki)", "value": "ee387ebd9710923fd37b16366c009848013701d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382179, "uuid": "51787476-0027-49a2-bada-0945e8c74add", "comment": "Malware payload (Loki)", "value": "eb2ba25c933a2d3eb784b2db08dab688e7801df1ffedd0e95fb50497c400c7a8d8bc41e601bb86015fd87c2673eb7faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382179, "uuid": "75d2e6c5-d629-4727-974a-6877661d80e4", "value": "T11FC437BC315035AFD633D873CA64AC10FEA024A7A307CE079153158B9E0EA579E5DDAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382179, "uuid": "37da8a4d-456b-425c-abdd-81487ba58721", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382179, "uuid": "f17d1d95-6ef5-4aec-beb8-6903b18957ec", "value": "12288:e43a5aXblplsKlfMcSYqbXu+tWmn+wzVCHxVEOMjtVv4:e43oMhsKlfMcS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627382179, "uuid": "9b727680-ff90-48f3-af40-a2c7509ca80b", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627382179, "uuid": "9df9101f-1bc7-4de2-8bf0-67c8fc8ba44f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382179, "uuid": "afba9135-14af-4dd3-9073-58aaac72ea3f", "value": "Payment information.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eea94b7-ef2d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627426236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426236, "uuid": "68f1b365-4bfd-4bea-b777-1eaacbe608fc", "comment": "Malware payload", "value": "58dc1cfd317058134777f77f86f62592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426236, "uuid": "f5b8557b-1862-46be-aeae-b26bbff7f141", "comment": "Malware payload", "value": "12a0e61c40e9664cd768c55b50d204e038067e9dfa34c04d0170426565eb2d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426236, "uuid": "c6b94225-9377-4a04-bfe7-eb6efbfe0e85", "comment": "Malware payload", "value": "22f19ee32e81d180be5c4e824d359456df811293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426236, "uuid": "ff26663f-eb48-408b-a886-74275bc0ccce", "comment": "Malware payload", "value": "ac02168cbff88bcc17525e4992ad1ca6f1c5e11f0c235d3b6752b330eb1e02cf62768b71fef9c6e70a204cc6a78e4108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426236, "uuid": "94f7faae-be09-45bd-9b42-86e5ce935708", "value": "T1E9A49E12B9D1C032C17222700D69FB759ABCBE20293545BB73D92D5BFE701D1BB2A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426236, "uuid": "ffbe9811-f09c-42df-907c-f224dfcc60fa", "value": "409f5d6d64eccf1b9873a7c796c3f1ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426236, "uuid": "a9014920-f191-48e8-b7e3-e4a51b768a65", "value": "6144:cc53ezqVrhiBZ84M/k22nZcrTEfCNV0cjd2shWR5dhTAOZZ8jXCSrcDCu:n53ez1HzMc2k0EKNV5dlE//Z8eStu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627426236, "uuid": "c642cf6f-afea-456e-a422-6b478efb4a12", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627426236, "uuid": "f9467ca0-6a1d-417f-9dae-335c834a9230", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426236, "uuid": "9e860222-baf4-4399-8d6c-1134f474f7e7", "value": "04_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14916253-eebf-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627379001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379001, "uuid": "3caf75c8-aeb5-477a-8ce4-8a9d6d164017", "comment": "Malware payload (Mirai)", "value": "bc09152c962c5b95c9f2da3e1d2fe6be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379001, "uuid": "9868f106-b918-46dc-ad81-af939084baed", "comment": "Malware payload (Mirai)", "value": "12b0bd219bde2939303c499b81c103ed059c35022b6da380346be992aa13bb11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379001, "uuid": "87d8c922-74ec-4536-bfdf-5dbde310a555", "comment": "Malware payload (Mirai)", "value": "2e311ec00f8a1dc06b51785573be1640af07640d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379001, "uuid": "f9f308cb-014f-41df-b1e4-41e7805b2a88", "comment": "Malware payload (Mirai)", "value": "be722abbc758e3a1d9ba8b322e68c4167862bfaf552844079d660f1409b82cbe44386f548b518ca8083d5fd01ede5c2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379001, "uuid": "f9b7d713-8693-4c15-bfec-5b50788b0ae0", "value": "T10843E656BC918F12C5D416BAFA1E118D3323677CD2DFB2129D105F247B8B92B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379001, "uuid": "f5f8debc-5c0a-4105-8487-edb4fb21e733", "value": "1536:mVnYc4C8KF+511jjr/ciLSI0ihDV4IWE:U4C3o9jrNDV4IWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379001, "uuid": "5730ac8f-34ea-45e5-b864-66996ef511f6", "value": 56084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379001, "uuid": "fd16b276-d0c2-4170-9f63-d4855052570b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379001, "uuid": "fe9b7a32-657d-44c4-b9bc-6ef8e5916708", "value": "bc09152c962c5b95c9f2da3e1d2fe6be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a219c140-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1627366354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366354, "uuid": "c3b5f5ad-0f87-4aa2-8a04-f14976357302", "comment": "Malware payload (GuLoader)", "value": "31841fda8c5fcdde447bd7db1f72fdd8", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366354, "uuid": "98da9bb1-17fe-4842-bd4c-1818830164cd", "comment": "Malware payload (GuLoader)", "value": "14644b90f9828394755196c3654eb53b9c7a30623541ce557ab59e5a7ca394dc", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366354, "uuid": "f88fe287-3168-4108-9f51-1a94c2aa0c2c", "comment": "Malware payload (GuLoader)", "value": "221afa8e02a9420b38c389f63b36231d2f4e98b8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366354, "uuid": "3db393ae-688b-47bb-81d6-9b13dca3df8d", "comment": "Malware payload (GuLoader)", "value": "b64b1c8aff6fb30b2f9be39fdb1184f779508de284681f7fb96ca31c5e23389a8526572160351ffffb27fe460c9cede0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366354, "uuid": "58427451-d868-4abc-8d53-dda8b92da476", "value": "T18F43021FB232055E4EE64C2DBDB8244F5CA4EED7C89716D781847D3C59AB8349EC4B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366354, "uuid": "b0fe0c5b-69b9-4722-b790-c976bd0f2cda", "value": "1536:syVI6mUJfMUQiLQnSwMJCFOOMolikhvx1Sd3E1pFTJ:scI6mUVMUQikSwMJCFKojhvx1Sd6/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366354, "uuid": "173ffc09-630a-4e18-9434-692efebf706c", "value": 60144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366354, "uuid": "0e31b6c6-cfdb-4d7c-b558-fd81040a4e09", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366354, "uuid": "4c8ad426-9b58-4394-8b5c-9bc0254767d5", "value": "RFQ-PO758596.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f4d758-eedd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627392014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392014, "uuid": "ebea0d19-e564-4f2e-b9b8-beaf8bb83117", "comment": "Malware payload (AgentTesla)", "value": "385d9d7dce288d12688ad65b0c262f0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392014, "uuid": "ae40334a-eddd-407c-a9ed-25fc0c903e56", "comment": "Malware payload (AgentTesla)", "value": "147ff22bdcef3aa73f1f3231fd85310f55b02535f2921db4e39dc84954f4faae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392014, "uuid": "93398b81-ee7e-487e-bd79-8e3ccaf896cf", "comment": "Malware payload (AgentTesla)", "value": "abb40f1e00da3e6613d81c54d8f995e57b5f27ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392014, "uuid": "009534cb-d71e-44b9-b8b0-3aa6713b32eb", "comment": "Malware payload (AgentTesla)", "value": "7f3286b3cdd517e3fb30bbd6b91b56d51f519ea44ed5b53b4029e6045d25e82fa3e29550af999167e1ab989b01b52ead", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392014, "uuid": "98e4907a-d3f3-4f94-9b61-1fdc64051654", "value": "T165713AD4657908B2EFBB98F3CA39FC2001D5F82512CE344AB45E7EA52316329C983981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392014, "uuid": "1ca1fddd-db37-409b-901e-d9cd171ec8ab", "value": "96:cCgrahczeBu6PvfXFeYJbfMZn1nmxT5C/:76zeU6PvNeMEp1mJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627392014, "uuid": "4f5ce9a2-f1fd-4e98-938d-20d0b5f7d5f5", "value": 3674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627392014, "uuid": "b327cb71-a76c-403e-b389-8509e1fb7c78", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392014, "uuid": "0d3fed46-f57c-4d4e-bce0-a591fc7c2bce", "value": "EPRD-ES210001A URGENT RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda4add9-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627372064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372064, "uuid": "d8e0a247-8d35-4222-ad38-94db4559a320", "comment": "Malware payload (Dridex)", "value": "63922c2487337188b76e721d86ba1a4f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372064, "uuid": "8132407f-5cf3-4966-91e7-0b792245fdcb", "comment": "Malware payload (Dridex)", "value": "1718966d91a317e8d16a0015e8f24c295f8ce978af37acef7cdbc9d76934c100", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372064, "uuid": "a102a80e-b4ef-4bf6-bfac-c761068f69b5", "comment": "Malware payload (Dridex)", "value": "506aca93e90417e91bdf5cde5095aa07de62acae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372064, "uuid": "b6dcd6dc-06b7-4766-a9cd-fa16bed074aa", "comment": "Malware payload (Dridex)", "value": "87ff587951ea5775f696e2f4eb3a950d0974e492882363ba62fd3becd1a455a8839c5a4badd3e75dc73cde940da45b61", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372064, "uuid": "67629c33-d935-4fce-add2-e4e062d49c12", "value": "T1CE04CF51D2DF2AD9C41E87BC11947A0976707EC2CB68C078E266C4BCEF7BD4649E4326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372064, "uuid": "2545fc97-3383-4fce-b972-3c42d59ebde5", "value": "038ee71bd4ea63acaf586d3475ef17a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372064, "uuid": "53a5c397-7a6f-4883-985a-108c08dce7b9", "value": "3072:syY5bY8XE+kkqh84cKcv4FinaLzL2rVQLOmpvNbTAvDstOr18T:PRAkkk84e4wne2nmhFAvD4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372064, "uuid": "5f92000e-4665-4664-a8d0-fe3cb6ed5900", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372064, "uuid": "10e5724b-3ebb-4a4c-b9f1-93fcbdc51f7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372064, "uuid": "1bb7c538-82fc-4b6a-bc0d-e76af15f8af4", "value": "hsy_utu8_12u_v4.4.7.0 (3).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5536805b-eeb0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627372667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372667, "uuid": "92f9212a-a83f-4130-b22b-e4b9ad510501", "comment": "Malware payload (Dridex)", "value": "6a27e232270583b5c1796cf988d79ee4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372667, "uuid": "3730ae33-58ab-4a04-a56d-f12045434fe7", "comment": "Malware payload (Dridex)", "value": "190b2cdfa53eaab02c24d69923988103a84cd2862c6c9d70a18feebbb3f0bc64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372667, "uuid": "22193841-44b0-4937-a0c2-07c16bf29947", "comment": "Malware payload (Dridex)", "value": "94e9f16d09a2031ecd04631782875eb95109dba7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372667, "uuid": "7bfe55d9-c9b8-4090-b682-6fd5d908225f", "comment": "Malware payload (Dridex)", "value": "9fd47ffd0eb97a158cb5a2ec7c3171297d648c36392d0ad08ed763f60204f7f70c911dbb66d0f4d8b2f0b6bc6a52a790", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372667, "uuid": "05521917-c988-4370-a646-eaf2398cdc2c", "value": "T11793E15CAD4D91EAF9333C3BD209079D185E640AA974F14A2448F34C3EED9A21F9F1E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372667, "uuid": "b93afefa-3204-4672-86e4-17068cd766b3", "value": "1536:/q21RSfOphVRjnS3+JbP3QymFFjZ+eY9FUb6lf8qNUHcielbkkhKwXMEeEdECgc:/q21RSwhU0mPjHolCcielb7hrXJCCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372667, "uuid": "093cf3f6-2dfd-4ea2-9d34-3bc60af2ad46", "value": 91429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372667, "uuid": "9bae9ab9-50b0-4fc4-9fd7-f955b25a274c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372667, "uuid": "999a08f5-be7f-4e57-9312-c987447b7ae1", "value": "Invoice_78518423.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec466519-eeb5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627375068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375068, "uuid": "e9a27b70-7d69-4db7-8d20-f997d7508858", "comment": "Malware payload (Dridex)", "value": "f6d7184a7a5ea749feb9d767ba4ef007", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375068, "uuid": "b8ef77b5-cde5-4fb0-946e-821c39eb2cf2", "comment": "Malware payload (Dridex)", "value": "19224bfca1af04c5548f61f93877dfdda1194f9a3b018385d72e5bb96cc8b00d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375068, "uuid": "f6df051f-1c7e-4155-8cf7-777ed190243c", "comment": "Malware payload (Dridex)", "value": "fbbf4cd832b2dac5618d953e50a2f285ce529e39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375068, "uuid": "4329bb22-20e3-42e2-b4dc-41e3f57acc2a", "comment": "Malware payload (Dridex)", "value": "383a0c1e5b47da468257cb31b29a7868c4cc8844fd02dece1d5f9a006919597ff0db1c55b633e65479162bd2df407e8f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375068, "uuid": "14c55df7-edd7-42d3-aadc-4028b72937b4", "value": "T19204D161DBE759C5D7A3C57ACC8CA17BD1293C0B8A6CD2BC6208D2CC897AF0CC5A4D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375068, "uuid": "a98be1c8-430e-48e4-8a18-f0224c9eacd3", "value": "89aebe8644a760ddbd7c2e801228e7e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375068, "uuid": "631105c4-7b8c-4454-b6bd-b35e8b491da0", "value": "3072:m3NLuxQI4JTJlYDFS6t2NAgEaakq7MCi6TM7ELNfFln:m35PB3ot2ygEasni6TM7ELN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375068, "uuid": "154ae0ed-4218-46c0-b2fb-2d155a0f3196", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375068, "uuid": "13f6df56-4f61-4a39-b191-3842317cebbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375068, "uuid": "800e80ca-5eb8-435b-9bea-649688f957e3", "value": "hsy_utu8_12u_v4.4.7.0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d085cc96-eeda-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627390913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627390913, "uuid": "9786b5cf-da83-46a6-a848-d119c5c4a249", "comment": "Malware payload (Mirai)", "value": "0dbb1190017d9959933b36b05e49a1c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627390913, "uuid": "bd0fe7c1-081b-47df-ac47-e1f0e1361918", "comment": "Malware payload (Mirai)", "value": "19ddd93024d0cf74acf046476e138a66a1b851da4fb49911794f731f39fa2c1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627390913, "uuid": "e7edf40e-9978-4bff-915d-a2702b76b046", "comment": "Malware payload (Mirai)", "value": "01c185f26dd219f3a44630087500f912cecd94ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627390913, "uuid": "31f9fb54-3c05-4674-b617-29875482edf5", "comment": "Malware payload (Mirai)", "value": "a7a17d67acbfe4248ccabb4eff3c4860581a994656b7a09ee89cf6d598fc9022562b31b815d249b67cb28a12bfacfdbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627390913, "uuid": "3b5359ff-25c8-47da-bcc4-5f992ad1ec39", "value": "T15664029BEF62AC6FEC574BB015570B1A77F8D5C9D3C69680B32889443CBE341A7602C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627390913, "uuid": "d8c0b930-d1a3-4ad0-b7c2-e275364ca72e", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6cov5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZncsPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627390913, "uuid": "d9f4b4c3-c3e4-4a59-90a9-4fb9e59d9ee1", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627390913, "uuid": "e20bbe64-35d0-4906-bc34-eb4ab1f886eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627390913, "uuid": "bdb48c26-8b93-4d5b-9559-268e95adb3eb", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5786f024-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627384697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384697, "uuid": "b18b715d-ea31-4257-b318-f020e9ab668b", "comment": "Malware payload (SnakeKeylogger)", "value": "334c0820434d474ffc6d7347f8c27697", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384697, "uuid": "15d151bf-0f4d-4398-a288-903fbac2f7ba", "comment": "Malware payload (SnakeKeylogger)", "value": "1aa71ccdef644e05966553af027e6434454c8e76a1e04522a7ad2da789d8f248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384697, "uuid": "6c7b2737-cbe9-4226-8146-7eed23f21aae", "comment": "Malware payload (SnakeKeylogger)", "value": "f0af5e6bb35f3b10f26386f4ad77db78ed0b4a72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384697, "uuid": "11f52f3d-2255-4541-9bc9-6d910f0af36d", "comment": "Malware payload (SnakeKeylogger)", "value": "644f4524c6008cd4d210792f0597a8985048aa15ab65eb568d26be6d4c10d55449982da953a5f74597dee4e06bc39685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384697, "uuid": "a8864a21-c441-453b-87f1-7dd418276350", "value": "T1B1C49DF83539775FF493847E64B44CA6696020FAC92EC792F72341ABEF0C49B9940297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384697, "uuid": "a3ad1e32-d468-4866-a508-06de69ddf18d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384697, "uuid": "c7099b19-892a-4d7f-80fc-ccf0579bfd8f", "value": "12288:WapTqZxyRlYoeibexh9mu+02dG0cMBxo/c7mo5oFCEkv:WiTqfyRuoFbC8j0sG0J7mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384697, "uuid": "359e28cb-c26e-4898-8519-5806578c048a", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384697, "uuid": "01ad8a00-3cac-48d6-ba01-233d43095ed9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384697, "uuid": "afb9dcff-a382-4265-ac5e-d719ad2f897f", "value": "STATIONERY MATERIALS-ORDER SUPPLEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2ea7ec-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372142, "uuid": "f6a9b6f7-3573-457b-8f22-2cd99ed1c110", "comment": "Malware payload", "value": "e17a3c0ad6d917748ff877d91d5d182b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372142, "uuid": "3343fb03-2532-4144-8b70-e0421db3ce25", "comment": "Malware payload", "value": "1b4124504d2cf8ceb19db4047b24ae930b45c7698cf82b5910dc96088a0a746e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372142, "uuid": "25f0ae21-d411-44cb-9c0b-2966061ea248", "comment": "Malware payload", "value": "3d18418fc45609ec598ffb57affa69f72d73fb9e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372142, "uuid": "ff46ee8c-7821-49c2-844a-298e3ea56a95", "comment": "Malware payload", "value": "35ccf6aea45ef9ef55394d57c43e23afd528260f6f299c976eaa72358db5963de0260fb8426bf3b90bcd224fce5790e7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372142, "uuid": "b1feb41b-b180-448e-939f-906ea2101c83", "value": "T1AE71846622381843CE4B86F7C0B6F81549F1F13AA4C71695336DFAF10B5B37A9876543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372142, "uuid": "ec7f9ce2-f637-4d47-8155-15242c248bf7", "value": "96:cF66CiTpPCvPSm7THrovkVoFEhFCihNV4W:DDEovRzyKf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372142, "uuid": "b243343a-73a8-471b-bd94-ee57105c73e9", "value": 3613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372142, "uuid": "25dd5ad0-9fbe-4035-936a-2c5747f65650", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372142, "uuid": "d2713451-583d-4578-93e4-d4c3e9d5fc8b", "value": "Erroneous Invoice Received - Request for revision..doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0108309d-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627372096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372096, "uuid": "830046a8-29b7-432e-9209-ad284107741f", "comment": "Malware payload (AgentTesla)", "value": "dc27adc9ac30cc0de96a0babf896cc74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372096, "uuid": "1d06c321-a535-437a-a442-06918de58ec3", "comment": "Malware payload (AgentTesla)", "value": "1c70882051a5b725ee8ac98b24ad6e6a1b867dcad1cdb5acf82e84fe4f8cc109", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372096, "uuid": "8c0e723e-6543-4803-af77-b56ada85ad07", "comment": "Malware payload (AgentTesla)", "value": "984fd4d264aad2432654aee42fefa1d2c7191081", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372096, "uuid": "a95d6ba6-76f8-4cff-808e-88c2aeac1da7", "comment": "Malware payload (AgentTesla)", "value": "67b5933f7f10c8f053385cccbcf2c2e19e1e8e5c4cdb62b37a40fdac57f5425da4c2f724c949bbfd317479584b983e6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372096, "uuid": "582e9cb6-7a53-47d2-b6c8-9104926d2301", "value": "T14DF5AFB876047DE6266F576BCA96ACDD03B617239ACBA4CD8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372096, "uuid": "9446b4b9-4a56-451f-bd1d-900eef6c1938", "value": "24576:DXVU7WddX67lBIMng5Ks7HxYSw77HL6POSCKQmAuxm/nfJQqiWmVHvoWxRoieWNd:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372096, "uuid": "a94d9807-ee71-4edf-a7ff-9b7d01719dec", "value": 3465294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372096, "uuid": "4cc7e720-c15f-4265-9712-1438d86483bd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372096, "uuid": "e515fe30-8f69-48ed-bc53-27a4658070fe", "value": "ABSA Bank_Payment Advice copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a56aa6-eee7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627396208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396208, "uuid": "ef08485b-0019-4074-bd9f-d88c7cd3cbd3", "comment": "Malware payload (AgentTesla)", "value": "76a240af49acdb8ff5396abb32f84e5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396208, "uuid": "636cbe9a-a4e2-4573-9b7d-a522b0281bca", "comment": "Malware payload (AgentTesla)", "value": "1d97f0b09573ff206fdc36f12a6c6f30cb55fed8c3789e13b321382421d9151f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396208, "uuid": "8f93bc69-f43a-44c4-8311-d88662317860", "comment": "Malware payload (AgentTesla)", "value": "a64f8bdf5ab921873c7fcac67cc380f14c5448d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396208, "uuid": "769a8a4d-e1f0-46cb-b0fc-79256c9b4ea1", "comment": "Malware payload (AgentTesla)", "value": "16d7e94d430f593cadf76d4450bba949b57090b26c20e09aa8f975b8931e5dab5cda22de233a67e3aec257d46b889b0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396208, "uuid": "696a0081-413c-4ed8-99fc-e937ff78a1f4", "value": "T11735E17323176B4CEC79C3B96829A045ABF5B407C31DE71C3DD8B0E96971F259BA1A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396208, "uuid": "e53e12bb-bb5f-4d79-94f4-9c98703ca3bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396208, "uuid": "2cc745a1-6c1d-4018-b0b6-0440e145109c", "value": "24576:Bvnxm8EDKrvDBFiX43gFAuiNHA6YZGdXCGKZA3c9duVk:77wiuiNHDfXCGKiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396208, "uuid": "d963c552-f251-49d9-8c6f-6cd1b65ed1e2", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396208, "uuid": "f2a96e11-9cc7-4651-a543-3899609436d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396208, "uuid": "d8261a5c-c800-4475-aca1-ca0d08f915ac", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ea872a-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627400799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400799, "uuid": "ea482c38-8a5d-48cc-86a1-f0c625610d65", "comment": "Malware payload (SnakeKeylogger)", "value": "ede697a91e18c73baf01ca677aa33917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400799, "uuid": "6912e6ac-36f5-4a76-8f65-27dcf936a8ff", "comment": "Malware payload (SnakeKeylogger)", "value": "1e2785c94e1501731c09b13b6f8156548704a36dd5b220efab73c06ed4fd6bfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400799, "uuid": "f8cf1b5a-5a6c-4000-bbb8-e94a8c548c7f", "comment": "Malware payload (SnakeKeylogger)", "value": "699f96d0a34bfacd78a8530f507769d5d18dccc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400799, "uuid": "c5e36db2-d133-4775-a488-d9248e39e84b", "comment": "Malware payload (SnakeKeylogger)", "value": "f9fad6b944d40ce1df6bfce617dab6441a3fe1ead4f58568c1e6de5b48becf37386c86da64b13ff6bfe369aec9210f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400799, "uuid": "a93e6db1-ac1e-4a60-b696-1fb7a9c73b4b", "value": "T1B7D4AEE4153C7F1BF0AF0B7D907140629BF090DBC9A9DBE4FF7644EA6F262A61051286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400799, "uuid": "e4d1609c-c76c-4d58-ae2a-e66842628739", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400799, "uuid": "6a9e5254-054f-4ad0-be94-f1058744649c", "value": "12288:HqKPU97PU9KzsQeVs8DIjOsBgo0q4wMVbMVSfFwhU9Dibb5CyGqCrgI/3JVi/KH:Hq+xIjOsBgo0q4wMW8wiJibdRxCrv5VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400799, "uuid": "13e1c576-3a3d-4379-9f6e-03b7bdfebd96", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400799, "uuid": "8f674469-741a-406b-8865-4ab5e8ab6a41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400799, "uuid": "85da3299-9a8b-4e0b-a9d8-6e710b0aa9b3", "value": "ede697a91e18c73baf01ca677aa33917.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b0329e-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402117, "uuid": "babc8eed-7aa8-4d97-88e4-0bdfc1751473", "comment": "Malware payload", "value": "e8af1892a757aa0f0693ce9677e69328", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402117, "uuid": "8b3856ce-a113-4997-bf73-c77022e8d9cd", "comment": "Malware payload", "value": "1ea32ffb0d84a4c157e12e6a3bd153a3cf3bb878ec2ef474fb547ee6fc7e9cc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402117, "uuid": "a56115f4-c504-4632-ba2a-b70bfd32629b", "comment": "Malware payload", "value": "f79c8d60ac27830351d257f2dbe00a72ea7b889c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402117, "uuid": "fa914932-b59d-4826-bc88-6f2e7b4cf440", "comment": "Malware payload", "value": "74827631869a383a7d388ed05e3ffb8f480e823ea12ee4e7c6652b3223a42521e8713536e4467695ee1e618bba62c815", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402117, "uuid": "3ff52295-e7de-4473-b552-1279f8de7346", "value": "T1ACE44B35B24DBBAAC13949328B56E19B43E0DD0F33B1F2DF58E951D82D13A654E7E082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402117, "uuid": "16ca1867-1f48-4aad-ab13-64cf86f10d37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402117, "uuid": "0ac365a1-fab5-4d88-a66f-852cff9475ad", "value": "12288:cWVsYVvjsbOyHpBvygTUxi2g8/W9tMyDi0+/FrrsLJ:XUpBvygA8vOaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402117, "uuid": "2cb4380b-3f17-449a-890a-5a45de3d3cba", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402117, "uuid": "0b42b83f-d924-495d-9276-7f1f91563125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402117, "uuid": "4513777e-015d-487d-9d37-4776a2b90aec", "value": "e8af1892a757aa0f0693ce9677e69328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defac99b-ef04-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627408976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408976, "uuid": "c88db18c-c291-417b-9820-776eb43448fd", "comment": "Malware payload", "value": "a73ed33e999fdce3a13cb8bfcf383f93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408976, "uuid": "5e2be01f-0549-44eb-9655-277785173adc", "comment": "Malware payload", "value": "1f8c9e1da84b788d49b60ea77f051f426c3f4f3bc5b05458d5249ddbeb904b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408976, "uuid": "32dc114c-42a6-4b50-a49e-b1b6c1e0bd6c", "comment": "Malware payload", "value": "ab4e4fdcdcf16b4da6902732d8ab1a6189a22e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408976, "uuid": "9f3bc51c-0d2d-44a4-a6f9-3012e7f111b5", "comment": "Malware payload", "value": "474b7b39fd87f8b6132a52925bd94132011e14ec663acc215006a5a3487c11d305d6f8b93cb698819beed07ca2f7170f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408976, "uuid": "32a1c9c4-5229-4108-9fa5-9fe276e283be", "value": "T167748C25E254486CE41AC5798973D211EAF23C460F72B6EF23D507273E36BA47A7E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408976, "uuid": "9ccda941-324e-4785-8a1e-8c04a40efc78", "value": "485b95ed0c69eb8b816da620685cf220", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408976, "uuid": "9da370e5-9e3a-4980-903e-7fa61f2788e2", "value": "6144:HbnezFzrzW3fGZfWr2EzJLTe6SoOxp/TusZ84:HL4xfWrZTBM6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627408976, "uuid": "40b195cc-8b85-4ae5-8c9c-dba57230bb6f", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627408976, "uuid": "f5509b05-a904-4a5e-85ac-50d626cd1ebd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408976, "uuid": "0b062441-40c7-4f1b-8b0f-d4b259ea2d72", "value": "1f8c9e1da84b788d49b60ea77f051f426c3f4f3bc5b05458d5249ddbeb904b3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccb78a3-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402127, "uuid": "41adf7bb-0690-4d4e-9a2a-351dc8408601", "comment": "Malware payload", "value": "0c46c876f6b444739b4f4cbf6fc9a2f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402127, "uuid": "c9329b4b-8540-42b9-90ae-cdc9a5c18017", "comment": "Malware payload", "value": "1fce43899f8b6267ca55c5f4ad85a48a191f130d936dabeae013f5d626068ece", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402127, "uuid": "f6ba413c-d543-4e29-a94b-229aaf35736f", "comment": "Malware payload", "value": "e241ae919b6554eb5c556a88ca2d7ca2eeb4ff98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402127, "uuid": "23ea86d1-60df-4991-8938-53ba4ada6e7c", "comment": "Malware payload", "value": "3bcc6bb0532e4332aa96012f2d1aaf8a4529b30c4a6a659634283a05a398ff95aa6cc24d3ff29971cb5563e63a4e1c96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402127, "uuid": "8b2665e0-6abc-4407-8dee-bc25b90f07f7", "value": "T108E4BEF83539375FF48384BE54B05CA2696020FAC92FC792F72341AAEF1D49B9940697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402127, "uuid": "74621935-6c70-40dc-9c9a-eb0c831b3823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402127, "uuid": "b8b16706-8c44-4e3b-8f35-764c209302ce", "value": "12288:PO4L4JqoYQade4zLCfVK7fpJVmXanThwO2pTCegk9DP91kY1NTA7mo5oFCEkv:KHYTdv4VOBmKThw7L9D87mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402127, "uuid": "05edfa2a-8968-4c24-a467-aa393ca743f5", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402127, "uuid": "298585fb-79e9-483b-a849-88d3ef92953e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402127, "uuid": "f127ea8f-1a89-401f-a25f-ab773e556503", "value": "0c46c876f6b444739b4f4cbf6fc9a2f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0341a0-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627399660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399660, "uuid": "966d2904-65e1-4ce4-bb8a-7d3936dea250", "comment": "Malware payload (AgentTesla)", "value": "82489381d072392f3075161bbb1ec8b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399660, "uuid": "3c846add-d3e3-48d7-a98f-ac59cd62a663", "comment": "Malware payload (AgentTesla)", "value": "2307054debb98d7c9ca5b5fbce5ca1210c49563dbe01d2fa28cc24099a2db022", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399660, "uuid": "d6b6f886-6335-4912-b32f-6afda06e9e8b", "comment": "Malware payload (AgentTesla)", "value": "5ac44b1ad6d31f14e22013792aed5033af1bed97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399660, "uuid": "c73a0c7c-b1e0-4efa-aa9a-ca974cbd629c", "comment": "Malware payload (AgentTesla)", "value": "6649fcda6f3ce98b7c5563a0a58169666cb8824ddef3b4f45d8f40f33dc3932e386fdb92cba0213f2f19afbf2008cb1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399660, "uuid": "f9d7b3c6-4440-4441-825e-26eb7fe19ff9", "value": "T12825B541468FC7BFAA5B22F0082C109C95BBDD2EC209BA79BE0E4D76B563FE5113D485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399660, "uuid": "a35f0dda-329d-493f-b0de-56a9959b0d80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399660, "uuid": "f71e01bd-920d-4bf1-97bd-eea7c893c437", "value": "24576:5kW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hu3AH:liecZ/X31fhmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399660, "uuid": "3c16cf30-775c-4684-b9a4-bbdaae0178bf", "value": 996864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399660, "uuid": "ecfe540c-928f-40d8-8f72-979da442eb9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399660, "uuid": "e952a708-5881-4096-b71b-31e7c675073f", "value": "Images.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821da1db-ef23-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627422135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627422135, "uuid": "c69fe8e0-e07e-4970-84da-6bc87274d2a4", "comment": "Malware payload", "value": "62b3afbdddfb88d96f76df2afd3bd8f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627422135, "uuid": "eb5c507e-95a2-43ca-a08b-abe689c4174f", "comment": "Malware payload", "value": "232d3e2c32dfde5713153e9ba4a2c08b6e51766f5eef4575a821410edef4a495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627422135, "uuid": "88f22bd3-d65e-450e-b395-4e24e01417ad", "comment": "Malware payload", "value": "02d47da3c2f80960e94abbd69a316c0ef9cbc298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627422135, "uuid": "5baef422-3bef-4131-b1c8-2eb68312151b", "comment": "Malware payload", "value": "326986d64474ce620131c34c81da7edc9352bd810b4de24fe09af7f4f891e46c5d7005ca5e2e2faef4f0cc4f92a0fe11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627422135, "uuid": "d19bafc9-f402-49bb-9784-2569b7271bfa", "value": "T111155CE93124735FF6A7C33DD4B44C5DAAE0746AC30A8747F537819AAA4C987FA110E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627422135, "uuid": "cdaea3aa-f889-4526-bfb3-04895eeed8e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627422135, "uuid": "543f77f5-707f-4453-a072-0451016a7adc", "value": "12288:phm0+j3A9shY4rVM9YCD/iB0MwCiItwUYqgQld+M3sbhAigCUUYOuP8geWE/HZ7Z:Dm0+jgGVMrzf8mGPt07mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627422135, "uuid": "a1f56f28-bbf8-4221-a313-9390da9a3c58", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627422135, "uuid": "d6315b8b-6175-4f99-a0d0-9c51128412c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627422135, "uuid": "30ef5f74-4bd1-4969-b1ef-b56305d0418d", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.14998.30223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfbe7a9-ef0a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627411548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411548, "uuid": "aaff8bb6-58be-483d-8e0a-5a172cd6b329", "comment": "Malware payload (AgentTesla)", "value": "45915cadc98f8a44bccd5a1478d05d83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411548, "uuid": "aef8041d-c574-4200-a369-1ce2996352f7", "comment": "Malware payload (AgentTesla)", "value": "239ab5d4355bfbeb28962fa372ff4004d94f5aa7d5c423be9c84548c521908fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411548, "uuid": "aa87c114-c260-4c12-ba22-a401337ed0dc", "comment": "Malware payload (AgentTesla)", "value": "5de6e03647a1c0afc6eb06726a91d6969af24411", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411548, "uuid": "d4c7f3f8-7183-44a9-8cf3-58ef6a70483f", "comment": "Malware payload (AgentTesla)", "value": "a50e3febb09f49e650c58e2a0a0c06384f543fa74211d3964dbc17aa5aeb06aadfd6e37514c46b907ed2002935fc4b04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411548, "uuid": "221c64d4-aeca-496f-828d-ccc5d9b6dc9d", "value": "T102A433ED1A26FF7086D1E638121F61AD421F2DD9FB9217F99D29C9ED3E0F510432920A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411548, "uuid": "cd181a7a-488b-41cd-829d-4360f87ec5d4", "value": "12288:ouu2Q1Lw67jrhWxsxMdpTNIv0cqZw2TlFJXuRzKGZ2NQKlUm+Hv:ouuNLwG/MDIMc6T7JS6lUmiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411548, "uuid": "21056425-78d7-4b6b-9421-59ed1b47b206", "value": 485712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411548, "uuid": "3a8110be-bfc9-4e0c-a87d-3f6aeb244424", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411548, "uuid": "b81ec552-d922-450c-9527-8838a2d48e85", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b907d3-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627375643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375643, "uuid": "55d970c6-aaa9-4090-8619-972b2bc07c6d", "comment": "Malware payload (AgentTesla)", "value": "91be015e2c0c979a2a5b84fc81164538", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375643, "uuid": "6456a765-3517-4de6-a7ac-b275614dfbec", "comment": "Malware payload (AgentTesla)", "value": "25ed1a3e7245151fbb0d15d7561a97be5d29c6571a8d6ccacfbaac4f22577f60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375643, "uuid": "f3131d3f-d963-469c-afae-0cb21dc75067", "comment": "Malware payload (AgentTesla)", "value": "14b768716368e0dbbd188d2aad80eaff8340f912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375643, "uuid": "cc822478-4f6b-4a0e-a4f0-01a4715745df", "comment": "Malware payload (AgentTesla)", "value": "8d723e64c6f23d7bd0ba5342ed256222ce06d2b4ef3159f635e32fcc7f39ed7b2d469fd90e247c081b7ca3405258888a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375643, "uuid": "e5ebe086-1966-4b41-973f-061899ac6bed", "value": "T184F42DE1A0508897E97B45F2AD2AA53079E26EDDA450CD0C569BB75726B330330DFE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375643, "uuid": "81b57ec0-0801-41da-868f-e9c17d8bf4e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375643, "uuid": "b05635c8-f918-473f-90a6-c5a1db850d41", "value": "6144:3JUwhvwF9SzbK9jeORaUJeYqxs0Iw6YRl1iU3ZEffnth+wCrGwNamuHF2OotwXEy:9cQU+fRjisZE3tvCrnNamueSXEhDLpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375643, "uuid": "3bfb0aa3-734f-4303-acae-ea83173ca4c1", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375643, "uuid": "83b105d6-278b-4ed0-bc7c-bdf3a9a30d1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375643, "uuid": "6a6d1847-d968-401b-a518-89964148d5d1", "value": "91be015e2c0c979a2a5b84fc81164538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d7aeb1-ef0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627411187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411187, "uuid": "90eab184-2c49-44c4-b00d-872d570976ee", "comment": "Malware payload", "value": "781256db85dbad532975ac504fca7212", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411187, "uuid": "75d0bda8-a87a-4b7d-9106-0520fc42a363", "comment": "Malware payload", "value": "2695ca5eb0ca655b21a700c8dee79561eec5915b51f290aca12be691e489db26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411187, "uuid": "abb1e394-66d0-434d-9dd6-1d45c715b779", "comment": "Malware payload", "value": "8e33d45c8b119838e3eadfadcbb71ce9d3d2fad9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411187, "uuid": "2dd1edf0-3cdb-46f8-a053-f3d0585f34f8", "comment": "Malware payload", "value": "a5c0ceb9f14ca12b18884f4a7c3fa2449a7532269a2aecdac734dc66aa2606b8aadd12a0fb7a04783a0e855407fb5d35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411187, "uuid": "5119d686-2aff-47a4-bd9b-9a6e6264f9a4", "value": "T11A03F19054C76AB3F653187EF6B40022A22D5378D4DA63694B48D60C8EE30C7D6EEE73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411187, "uuid": "df1fc2e8-82db-4b93-8286-f88194d4f078", "value": "768:dbL9T2anO9m9YOUWFN3+FoSvBmP/qOhrbixXrKe4pOM65PHbaSq3U7jl:BZtnO9m9vFN3NSvctr+R2e4pOjuuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411187, "uuid": "157e7a2f-3b28-4364-80a4-ae57973b182b", "value": 40320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411187, "uuid": "725b34c7-6eae-4531-a5e1-36bf883bc609", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411187, "uuid": "d7ac8e9e-b797-4e35-bfda-aa3af1be79cb", "value": "781256db85dbad532975ac504fca7212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf56883-eebe-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627378557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378557, "uuid": "d7e3e6e2-d7e3-408d-b0b3-9579f4e3b49d", "comment": "Malware payload (Loki)", "value": "acef407cd9b335c0c1ca6582aef98d35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378557, "uuid": "628acde5-752a-4b2c-b7bc-c119109ed642", "comment": "Malware payload (Loki)", "value": "2706cd9c8993267a695a8580ff5987c821093bfea0de05b561a98ac020b373ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378557, "uuid": "773ae8b3-feeb-439f-875d-532135014675", "comment": "Malware payload (Loki)", "value": "28569bb0962cbe06d1344a61aa8c426746494632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378557, "uuid": "8e4bfb0e-131d-4ec5-b588-305ef39d8f5a", "comment": "Malware payload (Loki)", "value": "8d2ce31e9bf2bb4a170dee7fe92eda41431250982a45e66d8921d838220d8144ca71e5ad683eb0c7e9a3382a2c44b808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378557, "uuid": "e4457cde-33fb-43b2-a39f-53ba13efeb6d", "value": "T1D305399D365072DFC86BC936DAA81C64EB64757B830BD203A05716ECEA4D99BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378557, "uuid": "4c5ac8a7-1a74-4a68-88c9-7bd242438c9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378557, "uuid": "cc9ccc02-a61b-45a8-a062-a6d8e5783605", "value": "12288:7E3CyWQuuvDBddbgYUhKyW585/Fy02EfedMWr5mpmZb03629fZQCcgV8oVe0mo5g:7UrTuMddMYUs+XaECMuBSR1kgV8YE4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627378557, "uuid": "29ce8f7e-7b05-41e4-858c-6d0b039f64ec", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627378557, "uuid": "95b7181a-7356-43e0-a9d8-88911c85273a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378557, "uuid": "f7c90863-97aa-4f81-9fde-e0cd0b5d82f7", "value": "PO2021.27.07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb233df-ef28-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627424409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627424409, "uuid": "e9d91d6e-c950-46f6-b369-2e9efebfa9f8", "comment": "Malware payload", "value": "3be1fa609b4f6efa9d30b5c75810f863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627424409, "uuid": "1cb9c8e7-c2db-4097-bb42-065db42e6298", "comment": "Malware payload", "value": "27572043b01a99f3901af4bd40faf03cd04e722e3fb7ba866ccdb3b2d3fabb11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627424409, "uuid": "3fe030f3-1a53-4a18-a38c-8d60a0799755", "comment": "Malware payload", "value": "61dcd8a4bd4641a7cc4800b5aea9ecaf7c6609bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627424409, "uuid": "fda931e2-34da-46a9-b619-c169e8d57798", "comment": "Malware payload", "value": "9b3c40a743e4ad0edbff6ab3f09d3ba99ad84ba4724fa2009c6e217f91576a003ec33f4cdd5e9c8b57d187249711b3c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627424409, "uuid": "b43b5c61-c19a-41b2-bb74-48d2a4138c63", "value": "T1AE054BE93224735FF697C37DC4B44C5CA9E070AAC30A8747F537819AAA4C987FE110A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627424409, "uuid": "c875f5b9-f204-4ec4-8c8f-cc5aa2a4cc56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627424409, "uuid": "6d55077f-df26-4f5d-8f75-1fba222f9e64", "value": "12288:5comEX7qK3Juo7GQxlZCtzZgDPMpnonR94cwrapd+TFsl9wTcT2koktrTodUsWta:6omEXlkGTMyR9X9rS47mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627424409, "uuid": "be69ddc5-95a9-4820-a119-f0044a50ec20", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627424409, "uuid": "5d18a210-18ab-4f71-9d16-d626ae104d10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627424409, "uuid": "ff744f48-6e3c-48a8-84c8-e2f238767320", "value": "klSsrzxwsbxeJQh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f285c5-ee81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352395, "uuid": "02a06f0a-7869-40bb-ac88-49c9ba436da9", "comment": "Malware payload (Mirai)", "value": "99073d53cfd30eae2984cd5810155d37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352395, "uuid": "44a6fb5e-5815-48e0-9ca3-a4a4bad2e7f3", "comment": "Malware payload (Mirai)", "value": "28101d2350bd804110a38508d531c582ab7b59ec657300ce610ce00898e3322d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352395, "uuid": "41a1d854-03b7-498b-9ab5-c8e80739a9c1", "comment": "Malware payload (Mirai)", "value": "1f0a203184461e5140785ecf75094eedfe370254", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352395, "uuid": "81b49312-03b4-4bdd-9082-672942e5446a", "comment": "Malware payload (Mirai)", "value": "b165520252aabf091eb484b76c7126a034a63f48032c350e0ffa5fc1d4e1f0b621c95825dee3f26c7894afb9b25a339a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352395, "uuid": "e21342aa-07d7-4763-86b5-92805eb42fd4", "value": "T1A9C2E0D5E329AEDDCFEA9B75FF61D3A637F9570B6212490CA1D093413C0682A6005EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352395, "uuid": "2eb99a15-fd8f-4b90-8692-d54df91dce2f", "value": "768:S3oFOHy+YSHwuGSQuy3gH3gg+5Zmv5kt0Hl9/f4uVcqgw09E:whHt/HZU3glQZm66/f4u+qgw09E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352395, "uuid": "25700fd7-c575-4d11-a388-2125a63cb8d8", "value": 28120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352395, "uuid": "93ed46a0-22f8-4653-9c7d-058be1058b01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352395, "uuid": "b1950bb8-8c3b-407d-90ab-12dface339f1", "value": "99073d53cfd30eae2984cd5810155d37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736a56aa-ef2c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627425975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425975, "uuid": "5ba528ae-84df-4f30-b0a4-26aa61fd0338", "comment": "Malware payload", "value": "40654137f8d1d0ccbba0977727d78103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425975, "uuid": "db53a799-9db3-47d7-977b-082f07e44b38", "comment": "Malware payload", "value": "2894f5d5bbcf64806812bbaea36a250a3da8953d42de1bbb3b337f3c9b42411d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425975, "uuid": "82a5bd04-eea2-4bab-a602-942181a47c0c", "comment": "Malware payload", "value": "5681f27fad2f056fd2b108c834e975ed011ebeda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425975, "uuid": "b0a310bb-b3a9-413e-ac50-69c65a4f9dc2", "comment": "Malware payload", "value": "37c78299acbdfdfeca2701c12784ca6d247d7891728bd99c5c9d4fd498c26243f6f17104ba6f0afd96b6157f7d221380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425975, "uuid": "f9a84605-e1b7-44bc-bdd3-205463701a52", "value": "T17215F1263227A258DC3883F90C24D1B16BFDAC29663DC3792AC5AD7F7D736785AD0640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425975, "uuid": "73713040-3783-4089-876d-0cb9378c8f77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425975, "uuid": "0088afb0-4002-4568-86a9-9fb42587a7a0", "value": "12288:kSGyvUIZbVlBPI2VBPXUG4P82RdZpYLU9H0GGFSXbPJ1v6Q+:zvDBlBPIOBPXUkYpYgR0Gv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627425975, "uuid": "44b37910-09e7-418f-9777-96b131b09fe6", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627425975, "uuid": "609df6a6-25b0-48e5-b67f-f2bbdb0e52d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425975, "uuid": "aee7b337-db53-4c7f-8f94-50b8aa272755", "value": "requestings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47911cb5-eeb0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627372644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372644, "uuid": "dbd56745-89ab-4376-b42f-c7ec3d83a1da", "comment": "Malware payload (Dridex)", "value": "86c63e5a375f54c79cfa007828400a5d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372644, "uuid": "c76c711c-3ff3-46ab-938d-cb303c829882", "comment": "Malware payload (Dridex)", "value": "297fa628e174f62edfc8ecf1e4ec79d8f177fe89308a0c04a0b55693af0a776f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372644, "uuid": "194c96f1-79f5-4596-ad0d-5b328dc1215a", "comment": "Malware payload (Dridex)", "value": "858168c7285d60d905470d70c32962a1367ea947", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372644, "uuid": "35d1d76b-8296-4960-8cd5-32a373ec52d1", "comment": "Malware payload (Dridex)", "value": "85c9cdcf0f7fca353d7e1154019a0c9e47174bfa7fe4a0e81300ad62088512846e809be444b4d8ece8fa0295ed7ef0e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372644, "uuid": "1e735ffd-c508-4c51-9c33-1293af7d6719", "value": "T1CD741289E173D19AFE5F0476A9811FDB91273E33C1E89970F7312D3EC11AE6A7A4044A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372644, "uuid": "df0c5b59-b54c-491b-81b5-a7353cd9978a", "value": "6144:23j+sWRo6tcJhv7Bzg+8h6F493OzNStil3SH0Gon2HC:2T+Zenzdl8OLzNSt/UJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372644, "uuid": "cfde93d5-327e-41f3-bbe0-a6ef1dbc5017", "value": 340471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372644, "uuid": "81847a02-2796-4633-915f-eb6c272c81af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372644, "uuid": "6589cf6e-7483-4f4d-b8ed-9a6e80cce202", "value": "Invoice_3326809.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd4b058-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627384919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384919, "uuid": "dee29052-2689-4ff5-8c7e-97e8aade330f", "comment": "Malware payload (Formbook)", "value": "178234763bc642636b72225d29674ee2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384919, "uuid": "043bdecd-62dd-49fe-a994-69b41a14cedb", "comment": "Malware payload (Formbook)", "value": "2a4103bdbd7ede598db2ed222c11aa5680fed10ae2a4b88930c2c6c03d48a8a0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384919, "uuid": "15eea822-eff9-4caf-a914-56bd5a392b87", "comment": "Malware payload (Formbook)", "value": "3915c10569856955c0c6a785d834e1f649afa5dd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384919, "uuid": "a0864e4c-e55b-4a41-930f-e092d7ea9d6e", "comment": "Malware payload (Formbook)", "value": "fcea519a9b59b70697383696db5dcd88bd10e105501f4826fb0888f9b8c5e82f64c66b3ace1f3b1570dfe00ac5d03003", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384919, "uuid": "77de4baa-a954-422e-8605-67067b85720c", "value": "T1C2A423961D50853F1B4EC24CD948BCB00F3C7C8D88A66062259FABE57D3989F09E9E1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384919, "uuid": "56240c71-c144-463d-a272-df2c1b36d3af", "value": "6144:4x+98rCb5g95TV0FvoVtpgqXulS5TyZuKfzAGzqY66m4MxwCRXUFzof7MOSpK:Q+98ub5c5J0uVhX44+ZxbAG36eQ7XU4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384919, "uuid": "e4fb4446-b951-49a2-9f90-49552ff794e7", "value": 465713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384919, "uuid": "6ccd265c-e190-4d72-be47-3850a8eed455", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384919, "uuid": "1c92c533-77c7-4b0b-b814-616561dbfcd3", "value": "Sales Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8081230-eef3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401582, "uuid": "596e3c26-2a9a-4819-bbd9-9dbafb2a67bf", "comment": "Malware payload", "value": "4ff2f77e4d4cf8207749dd70205c6551", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401582, "uuid": "962d3ea6-a966-416f-bd89-b5c7e640ee52", "comment": "Malware payload", "value": "2b2b2d652f0df53f1bdf4eead3ef92831132eacfef595043033d375dfe91c8ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401582, "uuid": "09b4b704-0cd3-4dd7-b952-4a556909990b", "comment": "Malware payload", "value": "4f28db25dc9b18f918d9fa74ae85b549a4128e29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401582, "uuid": "933e3e2e-828d-4fa5-a58b-d04b4e2da3d9", "comment": "Malware payload", "value": "a8a8f35a1532565c75a4e54455bad2d6bbbd9a3a69b3f43a8149e0380b4db9df9fe08aec964549692d767bfa0d4ffe7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401582, "uuid": "dc63bd3f-e96c-4bf4-b79a-1c0be14a8aca", "value": "T1CFC49C3815984A23F27AE6F38164E600FFF156D3B211DE19CB93A1D71E16703698EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401582, "uuid": "f3ef5ac7-0228-40af-8810-60170ae05adb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401582, "uuid": "a55a0bf9-1316-4781-b7ba-be32cab2b0c4", "value": "12288:fBNHGGQofuuJ2niHrfhvY6FcVRSgtI6vV02OUVoa3:fBFQouuJ22rfhgXWCoa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401582, "uuid": "83450cd5-fa7a-4122-a63f-c8dc6ab49504", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401582, "uuid": "6f152a9f-27e6-434d-b37f-74368850374a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401582, "uuid": "337bc643-26bc-4e9d-9221-5f85ad19de77", "value": "4ff2f77e4d4cf8207749dd70205c6551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06742672-eea7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627368670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368670, "uuid": "6de03704-a254-4f2b-abd8-efdaceac2c8c", "comment": "Malware payload", "value": "191cdf93d899382d73d5bddc7ee0be4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368670, "uuid": "4bd840a7-5149-4ef4-9bdc-e18aeb8fce79", "comment": "Malware payload", "value": "2c0201813e18bb9db77aaa298fdcee07965160e9d3b8362239a4b620a910530e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368670, "uuid": "27e61333-e0ec-44ac-8d3b-91785c846733", "comment": "Malware payload", "value": "a1a3d10c63b2ad54bcd0e0b7a53fa4f04822ea4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368670, "uuid": "fce68919-d7e2-49d6-b0ac-c84f7aede622", "comment": "Malware payload", "value": "205eff4bc624316f7f4f6077ef1114782b15075ce865c53139d27e622c16932f8fa5323f30758555fd702c86d19e4179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368670, "uuid": "05966872-9c17-4662-b8cf-c90469f76398", "value": "T1F1D63310DCA6D571F95902393F4AADFFF1E38E020950380BEDADBAE64DB2AE40746535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368670, "uuid": "0ce707d0-7914-4849-8e56-12858907d88d", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368670, "uuid": "e4019466-ddd8-4073-ae87-90dee75630d4", "value": "393216:R8vqLnwpgM8MOsvb1g7fXscjYUxeehiguUYxparlj:CgM8MOsvKzVY1eh62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627368670, "uuid": "21848698-f372-4359-91ff-867ede5bb7f4", "value": 13096546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627368670, "uuid": "2eabb45f-7f09-4679-a352-29d2a069c28a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368670, "uuid": "624d8469-6a04-4752-9d7a-3143d25a8968", "value": "SecuriteInfo.com.Trojan.BPlug.3926.25716.4732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f23b0cb-eec0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627379502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379502, "uuid": "a6a10a0b-e299-4de4-a987-4edb04c1c161", "comment": "Malware payload (AgentTesla)", "value": "10f4301b2a3ae07b38c8153179a42e10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379502, "uuid": "226812ef-7d1a-4e39-9811-5b2c344edb8c", "comment": "Malware payload (AgentTesla)", "value": "2ccaa6433590b5f135f49de557167dd9bae9e2a80f5550a6379da77e336a0296", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379502, "uuid": "b86bfdc3-c045-41c7-b4f1-f99dde22eb93", "comment": "Malware payload (AgentTesla)", "value": "660432ba5598a91b4123a8296c5801dc21aaaf91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379502, "uuid": "ac578ccc-9fc0-4f50-a3b4-24d1191ba0f8", "comment": "Malware payload (AgentTesla)", "value": "12ae232d5fa595091840273a0fca7885b4135e960b93f6ef042f8c0621e596d858959769b5e8e58467df4f6e97d038ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379502, "uuid": "9bbce0de-5cfb-4548-a9ed-af82672eb975", "value": "T1A9B42331BB85BAF1E4744F7544C3AC982FE076AB5B63F25DF21841E53B53343960A8A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379502, "uuid": "5568a264-b81e-4091-b738-6259a9202b26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379502, "uuid": "432fd46c-3195-4d68-9c1e-d6883d9e7802", "value": "12288:obesi8qZWA/0BVNuam1+4xAQTvtAPqJgTJQsQDP1:Nsi8m0nNY+45RMb2DP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379502, "uuid": "86a35f6b-856b-4787-97d2-9faa12795a23", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379502, "uuid": "d16414c8-b33a-4e86-91b2-50be7263fe6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379502, "uuid": "8f7d41f6-faa9-4090-886d-b383e184ab45", "value": "10f4301b2a3ae07b38c8153179a42e10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b495c92d-eef9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627404180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404180, "uuid": "7fc0892b-a94a-48c6-8506-174c494dd23a", "comment": "Malware payload", "value": "6b0ab04930cae57ff38824d56966fa8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404180, "uuid": "aef194a9-8f35-4dd3-9f9c-79761bff70aa", "comment": "Malware payload", "value": "2cfb7adb214ef9393727628ebe22af87ad00d3bdfc19655be69b6f3617b9b539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404180, "uuid": "4d156d74-edff-45b8-9698-8775bb5b6713", "comment": "Malware payload", "value": "692d265b64797b571af7fa3ed56b8d3b0ac783b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404180, "uuid": "18c5cd6c-3d35-47ab-8226-376e55dbe9f9", "comment": "Malware payload", "value": "3101d875935685f07f4fade3404360eeb22794baecb579b94e0f02304ac9dcd27933438244c445642cb07b0b4e6951cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404180, "uuid": "55b0e366-8aa8-4622-8623-4924ccd46b99", "value": "T1F535F1253BC4BB8FC76E8D7AD5032800A3E0D5773607E6C66CE252DE248E79957211BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404180, "uuid": "76c987f0-59f7-4b31-8cc1-86ed2a45f5e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404180, "uuid": "c6723078-4f3a-4b1e-bf92-74e09f9634c2", "value": "24576:uiX9HNPKP3uQqgO81XPRS69kzNCc7rsyrO:p9tP+3uLEFs69kZhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627404180, "uuid": "1df394d0-0c9d-4e34-8c38-576adf4a91a5", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627404180, "uuid": "2b3a555f-0c89-4de3-9afb-fdd8afa0510f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404180, "uuid": "ed8f86c0-e832-44a8-b620-f220c325fde6", "value": "RE Outstanding SOA Settled.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54650255-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627366223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366223, "uuid": "0fa3c139-5903-4aac-b3f5-b84fd37b6665", "comment": "Malware payload (AgentTesla)", "value": "e078b475809986ee55948bb768ee9cde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366223, "uuid": "5bc39421-54e6-4095-adf3-e4dab64ee3d2", "comment": "Malware payload (AgentTesla)", "value": "2d0efd49d4743047d816c892185352bf7bb107210e325e1a8415d5803eb317fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366223, "uuid": "a2838270-0510-4943-bb76-d218e07843a4", "comment": "Malware payload (AgentTesla)", "value": "d226c78d1403e1d6eddf71391814ade0d3ee6099", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366223, "uuid": "f947a8cc-14da-4a3a-ad97-bb01a70e392c", "comment": "Malware payload (AgentTesla)", "value": "23f925e5c306f863dd385d680da405f6aa4502e8b5f2880c12802d67062ef80a158dc327bf77ee82fa960501723de0ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366223, "uuid": "0b651984-1a58-48b3-b477-44d34518a6ff", "value": "T11EA42394FA3EFA60F4C56848DDF4656D19926B5176D207240A3C5A1E3B22E0ACE7F3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366223, "uuid": "632af14a-8881-49e9-8ecb-34e44348995a", "value": "6144:bDycp1geLGVRLEJXoGJByRYThyyCGQuEnmubCT1VbVGQQfO0ciy4yyYdvdEZOZrZ:yUqMGAbJaYT8ygdmqlN2bFbIZ2q4upi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366223, "uuid": "f6d7d9d4-dcad-4534-96f0-ece7802876cf", "value": 465928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366223, "uuid": "c1f625b0-3233-47d1-8d56-0fcc4dba4dd5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366223, "uuid": "0d5c3971-7c36-4134-ac94-0bc3063617ef", "value": "MRKU8781602.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c111bfd4-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402054, "uuid": "c4725340-822a-4fa0-b47b-226a39fd7c3c", "comment": "Malware payload", "value": "891f97173c0a90ed3d336e303908b38a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402054, "uuid": "8ca80287-5ee1-4852-941d-41ac93bcd6a2", "comment": "Malware payload", "value": "2f25825c264a731f59bdee108cdd8fdf062501404952294c7fdbd4e46d4ccc7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402054, "uuid": "027c02b2-eaec-4db3-99af-8b6878b00941", "comment": "Malware payload", "value": "49a4e10a12d5aec836cc2b1cfcfce3784446929b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402054, "uuid": "c9750dc3-78cf-41b0-a930-4fd5a15bb4f0", "comment": "Malware payload", "value": "60f4e16e797d8aad8e7f3a37ded40818a435641493ddc9dd06fa9c0411ef7c871121337a057a1551fdb41ec1db1611e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402054, "uuid": "d234da55-6857-4333-aaa4-304b04ca70c8", "value": "T18105F1057B81AF4EC57E8E3680115D50D7B1ED2B670BE78B2CD232EC69BE7D54A03292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402054, "uuid": "73341ddf-7b32-4cb9-afc8-2fdec4e22154", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402054, "uuid": "7f14e3e8-a409-4823-bc71-52da39709cb3", "value": "12288:V6clP7+3veAzRiEUSl/wzEbLZrBeW3Ujdj5EqxugE9i5/aFC5MkkCT9NILJuROEK:V68+jdhUSxd1EWkhNE8ux9iBXx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402054, "uuid": "a82bb3ff-6139-479b-a3a0-e06e6dd05a2a", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402054, "uuid": "82fa2e1c-d630-4274-a23e-9b7e4bc2119f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402054, "uuid": "ea893987-ee82-4916-8705-74903d522e11", "value": "attached TT PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259368c5-eea7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627368722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368722, "uuid": "4d436563-c3c9-4ada-bc26-97a79343c9c8", "comment": "Malware payload (Formbook)", "value": "b8ae19595ed2b1c06372f904f28c8983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368722, "uuid": "0797d3f7-9330-4e2e-bd07-ac7320f7ecb3", "comment": "Malware payload (Formbook)", "value": "2fbe2f9ceef4deca8b67d6cb32dc3cd8ebd422a95c24cf4392837f95ad560473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368722, "uuid": "84cc5344-1b10-4168-9eee-e4bd4dca571d", "comment": "Malware payload (Formbook)", "value": "4a1255c9a563cca8f7fa8c5e466900dac63669c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368722, "uuid": "3ff10bd7-12f8-4146-b088-1edc3fd969ca", "comment": "Malware payload (Formbook)", "value": "e5da53cb82676609b007dc0a14e651b7a04986a6e432e46b513158eed030c3bf887d4a1d4d39728203b26b2e11a755ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368722, "uuid": "ead9b812-6153-4c59-88ac-d4a9b0bb38f2", "value": "T13EE4BDE4063C7F1BF0AF0B7D907140629BF4509BCA69CBD9FF7204E6AF262A75051686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368722, "uuid": "6dd9a130-6909-4685-aaf2-c51d8ed7e47f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368722, "uuid": "127d1534-b933-4d1f-a18b-9ebe3236da5d", "value": "12288:9xZPU97PU9GkY3Mv5ux2BxOsBgo0q4wMbWDYSkijDWbA/AqBqDcibYvw/oyo/F3:9xAx2BxOsBgo0q4wMq79ScAoUcGEw+/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627368722, "uuid": "65dd301d-7349-41ff-a987-f155ff190d04", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627368722, "uuid": "c3e52fc4-9082-4331-a9fd-7367c5b43614", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368722, "uuid": "d6048cd3-5bdb-4a01-a0c9-c6b44ecb5b3c", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb163081-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627414070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414070, "uuid": "535ae440-b05e-4603-9a6c-b53f032ea80a", "comment": "Malware payload", "value": "d388de58e08c4c7034a35d4c1cf72c6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414070, "uuid": "c404adf3-835a-45f7-90f8-6cc9f4d192a9", "comment": "Malware payload", "value": "323bf01a26701edcea0a59e1d34a7d3114d485472a0dcb2a4a44dfcab989a557", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414070, "uuid": "f3bcb052-7405-43e2-8bbe-dd8c4d78d323", "comment": "Malware payload", "value": "5345052159ce20f729b9e9366ae3b15ce9415b39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414070, "uuid": "bafc2fe1-4790-42e4-8bac-4f3c0651d620", "comment": "Malware payload", "value": "61a658be083051f6ae2744b3e911797d5fe2e944171cd9f1276d13eb35146f2da6121f1645c0accf4dd2de973fe823d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414070, "uuid": "1c4722e0-cb14-4630-a401-e19c32abcb3e", "value": "T1AF539EA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA57C656845FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414070, "uuid": "c80904aa-4ebc-4c13-add7-d1b2a12aacd9", "value": "1536:K/ue90IlCalyZyuhx+vACs2U/SO/Sfs3zO/QSwtPlCX+i:KGejAGyZyuhxaU/Sjf+iYdtPlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414070, "uuid": "009becbd-a251-4185-a27f-966689458024", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414070, "uuid": "c872063b-19cf-4839-adf6-d0e906bdf536", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414070, "uuid": "bc97cc09-01de-40f9-9f7c-60d6df28253c", "value": "d388de58e08c4c7034a35d4c1cf72c6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86cbe20-eeb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627373746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373746, "uuid": "4c1fecb8-749a-49f8-a951-c0c8931099ca", "comment": "Malware payload (Loki)", "value": "4d85e6c70760761a009957e9db240df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373746, "uuid": "9d4c63ae-e603-44ad-a578-d2b51bfba080", "comment": "Malware payload (Loki)", "value": "32894ea1274b19405c61b1ef24059a7e6b2854984a4c5ab6f349899ba64696ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373746, "uuid": "73d303ba-e15b-495c-92f5-a2932b8c78fd", "comment": "Malware payload (Loki)", "value": "729128422d7b4c6939f13a4f9f19b72976222a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373746, "uuid": "24943128-26ce-41ba-9b1a-5c4c6a43be3a", "comment": "Malware payload (Loki)", "value": "fe79aa1a6c4deaf8ad684bd8887ef4e93703b164abe1a8d2ab92d8c80191544189380e236645509032c9c0847f871bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373746, "uuid": "b61b9b60-18d6-4c1e-a097-c8dfcea563e5", "value": "T11B84493814985A63E276E3B7C565A200FFF01AD3B251DE1DDB93A1C71E12703698EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373746, "uuid": "bee98b9e-9144-40ac-931b-2de23735717d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373746, "uuid": "07ba9d4e-9e4f-458c-b914-35482df34d67", "value": "6144:WJGZ3R8hY5zbK9jCB3V8kBR16izT8vEhW7iP2yOvSxmLFz/yr:D0+qkP1rTkSWWP3gSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627373746, "uuid": "698b3ff5-7196-49b5-b59f-3e83c4d7cb3f", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627373746, "uuid": "2c5bd40c-ca07-43c4-8846-c815a8a95d41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373746, "uuid": "8a07f00b-9236-4d3c-8c0f-5756d6593dc5", "value": "Detalles de pago PROVV0003654043.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58989189-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1627400161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400161, "uuid": "de9e39db-18e6-4c5b-89b0-ad78f1263884", "comment": "Malware payload (IcedID)", "value": "0c85b4bdd02961753b9a14cd9a75e945", "object_relation": "md5", "Tag": [ { "name": "3055936464", "colour": "#52C0F7", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400161, "uuid": "8f085f05-00fa-4f56-a7e6-a255558fa9f0", "comment": "Malware payload (IcedID)", "value": "32e52d829bbde235d7d00c6c1752f7ee5114de97eee59b22957d0adfab84c9e9", "object_relation": "sha256", "Tag": [ { "name": "3055936464", "colour": "#52C0F7", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400161, "uuid": "88e46a8d-dc4c-4d1b-b4b8-fa995a46f1b1", "comment": "Malware payload (IcedID)", "value": "bbe0003a47b518f0ccc0d55c83328225b6b46b19", "object_relation": "sha1", "Tag": [ { "name": "3055936464", "colour": "#52C0F7", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400161, "uuid": "f4544a84-ae07-40eb-b2b0-24137e39ad53", "comment": "Malware payload (IcedID)", "value": "91cd82a0ce312002e3e7f3ad138f64b5deff088d9bfe9f3413f64fc2d58cb3a0e9692ab99a45bfb3694554c1a5c1e911", "object_relation": "sha3-384", "Tag": [ { "name": "3055936464", "colour": "#52C0F7", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400161, "uuid": "56383eb5-c44c-45b9-8d7d-7bc5a53cb5e5", "value": "T1B5140159E152EAC6DEA01C3E70E7415AEB648C326C497AA7443F3D49813E3E3E39B544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400161, "uuid": "075d9337-1138-468c-82a4-ee15d3ff653a", "value": "3072:S5KCDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xkp+N:S9RcGUlFzy4mpTHdrUc3/SsYAS0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400161, "uuid": "782142cb-adcb-4c89-a525-925ac5156897", "value": 191112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400161, "uuid": "fbac4af9-6f15-4ea0-8461-dfe355c4f2ed", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400161, "uuid": "b02de96d-fd68-4e08-b304-ceed731fc9f6", "value": "Purchase confirmation-6232.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fae98e5-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627365330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365330, "uuid": "1cba4d1a-cb1e-45dc-91cc-a2587776e5ff", "comment": "Malware payload (Formbook)", "value": "6b5c6aefc470e66a1d12bc56437f48a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365330, "uuid": "496503b9-7d7e-4365-a2e2-c317c3d96215", "comment": "Malware payload (Formbook)", "value": "35a2017af959b6e43cb129fc6c18c7e21bc0a1d850b1e74101bbb95d8c5bd3c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365330, "uuid": "9ae40568-2bcd-4917-b1e7-56b6378e4737", "comment": "Malware payload (Formbook)", "value": "e5c903c9a731c3abfbdb5141d926616bf7b54beb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365330, "uuid": "7c8c369e-07db-4d89-90d1-8cd047a90010", "comment": "Malware payload (Formbook)", "value": "dca2045bd78a90d982a9b8d2cd5f1cd44f08b45d5a9b58e71420e3acdf43f6a32172966a291750a131c3ef34851f0c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365330, "uuid": "798b4e12-5797-4e2c-ace5-c8796228285b", "value": "T1E1D4CFF1193E7B1BF49309BE20B1919319A050E9C879CBE4FB3352A7FF1615B6085B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365330, "uuid": "79d1efcb-9702-4959-93f7-29ca27d014d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365330, "uuid": "5bee67c9-f24a-405e-8144-5d8712024576", "value": "12288:JtOsBgo0q4wMtAoUL2J5ANhBPTtqmYojYgRULYyo6SA:JtOsBgo0q4wMYhxBqmqgRULYyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365330, "uuid": "8cd2336e-5758-4143-9f05-9b190fa7398a", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365330, "uuid": "c12b6c12-751a-4261-9a71-33bf543e4bfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365330, "uuid": "c6e497bf-6781-49f8-8de3-2dbd84fed8aa", "value": "REVISED INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e709ff49-ef24-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627422733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627422733, "uuid": "b8c7b4bb-265a-444b-9a3c-3d218df1379b", "comment": "Malware payload", "value": "b38951e206b97598f43f14093f010277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627422733, "uuid": "56b2edb5-f9ef-4a21-b5f6-2b05db3c36b4", "comment": "Malware payload", "value": "35bf6a470d0991a5ae3ccffab1c7d48b9fc72fe540ac7bdb26c636e39ea9e0ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627422733, "uuid": "8abe5aa5-fcbd-4ca3-bd6e-4c4dc7b40c62", "comment": "Malware payload", "value": "0f9abd35a624f7eac1a971d4dbc8b31e0811adeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627422733, "uuid": "fb8e99a4-5a01-4874-8e2e-189d73f8b1dd", "comment": "Malware payload", "value": "2c6f91c42eff1a448d250d323cc5e320e4a57ecbf920f74276a61d9ffd7a31e862589f99e47bf42bbc249f6833b80ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627422733, "uuid": "1ce607f9-08f1-4eca-884a-5a1b07d57f20", "value": "T1A815F1263227A118DC3883F91C65C1B12BBE6C26566CC6782EC8ED7F7DB367C4AD1641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627422733, "uuid": "7b53dfc2-08e4-4283-aec9-23466dc9aa37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627422733, "uuid": "af5dc479-cede-4fd2-9834-38776fd45de2", "value": "24576:MvDBlBPIOBPZj69CrTBcBuKZn53juxnD:0pPDPZ3auKP6xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627422733, "uuid": "de47b71b-f327-4844-90c9-8591e1c785c2", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627422733, "uuid": "63da42c6-9d24-4af6-9594-966d7cf66f55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627422733, "uuid": "b482dc6d-ce3d-45f3-80f1-c86b53d40b04", "value": "REQUEST A QUOTE FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b374a473-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627414057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414057, "uuid": "af2b9b18-355d-4dff-b57a-1943ad21a800", "comment": "Malware payload", "value": "fac4cc991087863d054c9cfbcf748e40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414057, "uuid": "b88ff288-7dd7-4c3e-906e-3dfa348d077a", "comment": "Malware payload", "value": "35ef760ec2c1de83fef0383dd0cfa2e6777f72e6783cdbec9179cc3ec3c70c4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414057, "uuid": "1461b296-5649-4ce4-9a6b-8b09e2e7d9af", "comment": "Malware payload", "value": "2bb0695526ce98327e9cb840c562b2de92dc976e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414057, "uuid": "559f8b6c-2a79-4616-bd79-707329988d25", "comment": "Malware payload", "value": "ee8ebbe0807c1543ee5eac6ca504577bc5183e702d4388fe9dd8599e12d970745030eff1a1e1d10a28291144a954ac6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414057, "uuid": "a8a61c2c-9f23-48d6-983f-5097954cf6f5", "value": "T1AF030784BC81C917C6D463BBFA1E42CD37292358E2DE33039D266F61778A82F0D7A655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414057, "uuid": "8f6ad7c7-9358-41f6-a76f-e6b18daa7733", "value": "768:fhGuJxjbHwanJBRD1LTogyDPrGQUy8gDiCtVWAJpPsqPgI/zVG:YuPJJBRDJEd/GQR8gD5bJphIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414057, "uuid": "5c31ca2b-d2d2-4485-b5e9-ddd521bb113d", "value": 37744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414057, "uuid": "effcbbfa-4ae0-405d-8c6c-cd629cdfbe57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414057, "uuid": "59a973ab-32c1-4a60-8901-ade594cb3040", "value": "fac4cc991087863d054c9cfbcf748e40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243614d2-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627400502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400502, "uuid": "97159166-63d8-4f2d-80ef-071cc4f0bd34", "comment": "Malware payload (Formbook)", "value": "321ebf1c2e57ae454232ee12b6892164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400502, "uuid": "33a05b5e-cb71-4f00-a1b0-1f6f24fdc9c0", "comment": "Malware payload (Formbook)", "value": "3759a4136f3ab450b1c26121511bdfea101baf948b580af60516c8c2d5c7b900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400502, "uuid": "39bf6ad6-1721-4aeb-a69b-4f9ae15858af", "comment": "Malware payload (Formbook)", "value": "db9f088a05203a6caf9656e59731f027adfe1bd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400502, "uuid": "dd7c2dcb-9f6e-41e6-bf7d-211d2a6cc30e", "comment": "Malware payload (Formbook)", "value": "055665a0f4c771438084f119a1c9ff5659f21c8817118a437c14a902b09cd38f8f949941ecc4f1a8a8da90b78b7b3232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400502, "uuid": "0495a098-636f-4cbe-976a-b4b4d37b4cad", "value": "T16A84E02938C1C072D577283008F0D6B19A2DBA321EB1998F93A1573E9F316D29715FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400502, "uuid": "5415870b-bc9a-4441-88ea-b490acc8823f", "value": "d4cc1601fd324eebfdf856765dda2bd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400502, "uuid": "4b44f97c-a90c-4d46-9c4a-8ade775a56cc", "value": "6144:cf4h+LDGoTfJGkGiJxRuEGt/b2j7sZA7kasm5uqv8nmqSiAh1NSnc8xND+OXmKKg:cfDLDGoTfMLiJ544iSXPonj/D+O2KKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400502, "uuid": "824e8e83-2293-44b2-9015-80a975bc2b21", "value": 392664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400502, "uuid": "b70f6f85-eeb9-4cc3-91a3-1f4581dc03b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400502, "uuid": "c7f56c29-6a53-48e9-a7c4-d3446d2419e7", "value": "321ebf1c2e57ae454232ee12b6892164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defbe5cc-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402104, "uuid": "ff1535ea-8356-4fc3-975c-7220a33ee2f8", "comment": "Malware payload", "value": "18e38eae3d407418b879271c9b5736bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402104, "uuid": "e475a173-4dca-4407-bb8a-1403bac0f3bb", "comment": "Malware payload", "value": "38ba862149962bc5a10825a2b818391624cda439fcb3f6212b75d84eeeb4f70c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402104, "uuid": "721e95c1-e2e9-4182-8b8c-9c6af4a24180", "comment": "Malware payload", "value": "922687da4673862f203b62884ac6a2cfb49790d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402104, "uuid": "df2ec5c7-3009-43c4-842f-3b716492faf4", "comment": "Malware payload", "value": "7e9facc4507cc8fab5e1271ce7da09d1b06b2f9a4129ce932e332f52312bfa7dab524cbe0ef0a3f418e5e56cf9beb7f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402104, "uuid": "12c6cd1a-93e2-4134-9627-09ba81a023c1", "value": "T1DCE46D21B992153BC30667BB8D1B9658E928FF10A85464473BE8FD3C4F7A7C678281D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402104, "uuid": "173b6907-2d81-495e-94d8-1bf309b14680", "value": "8334ffffda06cacb2b113ba9de8c078a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402104, "uuid": "525db444-1950-4837-8d21-2e6d87d9d77a", "value": "12288:mDPmOzS2AO+GBDfNj/nNImvYGU3F4JDW6xpYMeAEGGQPN+BRKa:0eJ2Aq9p/nWmwG845W6xKMeWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402104, "uuid": "6a854463-1b7d-4744-872a-3d719b9c4654", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402104, "uuid": "34432031-a6b4-41f5-be51-4796a0a55c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402104, "uuid": "82d79e65-fb5d-4b74-844e-68a682e6be7a", "value": "18e38eae3d407418b879271c9b5736bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20555053-eee2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627394053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394053, "uuid": "7bb8cb2a-5bdb-4a11-99a6-03e1ebef5a82", "comment": "Malware payload (Mirai)", "value": "1b16f53c6e378c0f0e80bce9ed05e48e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394053, "uuid": "6bc12fed-8490-4a07-b124-ac0fa92221f0", "comment": "Malware payload (Mirai)", "value": "38f817584b1d7e03755296f7a45f0a1abdd7bb757146066884a87606bb2b0c58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394053, "uuid": "b015217c-156a-4a1b-a782-7eed733da730", "comment": "Malware payload (Mirai)", "value": "c607a7082d7629f5270a5d09e5e436f342a06df9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394053, "uuid": "f0a2ccd1-6e05-4c4b-a042-6b0fd7fde1ee", "comment": "Malware payload (Mirai)", "value": "4e2767dfe677167a0341d076cdd47d4d4e7433a38885c4f26ea81fb92417f52720d245fa571f92bd38dff308a532a076", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394053, "uuid": "69e883e4-6d87-4abe-958a-c5d8fdee0ebe", "value": "T159131945BC81C916C6C42377FB1E52CD37296398E2EE33039D266F61778B92F0D6A611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394053, "uuid": "d097f3d5-c806-43e2-bd1d-477f62ef801a", "value": "768:TJESKMdnHwa5KCBiDOOU/gVyEPty+3jJCt5NPnbGACQppUxNo/+Zz4l:eSRKCBiD7UIYEySjQFnpAcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627394053, "uuid": "fc44c363-bc67-430c-8978-f63b163d6066", "value": 41844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627394053, "uuid": "d18f18e4-a87b-425e-84f9-c77fdbdaa1c3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394053, "uuid": "4c9d7639-73e2-421c-83b3-b2e78727196a", "value": "1b16f53c6e378c0f0e80bce9ed05e48e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910aec12-ef08-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627410563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410563, "uuid": "86294134-fd9b-4fea-808e-bf2f4416b989", "comment": "Malware payload (AgentTesla)", "value": "144141ae2aa727bc13fd74745b7a1315", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410563, "uuid": "8d624080-60bb-499c-b6b0-67d3c7aafaa1", "comment": "Malware payload (AgentTesla)", "value": "39237253378c85888c0281afc0190177c88c3d648089782de5ae1cab7e67ecef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410563, "uuid": "10b4b65c-0ea6-4fa3-8a2d-d4012e5bd1ca", "comment": "Malware payload (AgentTesla)", "value": "05c9afef4033721637adb0e8ae5bfe2339eab9af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410563, "uuid": "260ed6f9-8875-4701-816e-ef3d17b3878c", "comment": "Malware payload (AgentTesla)", "value": "e0f265c1be71a93253927fb7fc9bdb5ba6fdd921ddfd4f9d7c6a930bde0dd7ac1f701ecbf181d79f2d455d863fd7700a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410563, "uuid": "3a086bf3-72e6-45de-9dfd-51ac2809e77d", "value": "T14D15CF303550A48EC12A4FF6B95278705623BEEA5917E2C3289736FCD7BF3958906393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410563, "uuid": "a170541a-f0ec-4587-b47e-9df192878a16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410563, "uuid": "b5911a71-a9c2-498f-b9b6-ca231c58f7e9", "value": "12288:ogTTO+gEws5oUceh7zZfV3biRhCgfxbu3rcjaxWvU744VJjp:oxC3z15FgfxKwrcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627410563, "uuid": "d2129360-d700-436f-8fcc-a18c95d6592d", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627410563, "uuid": "13532548-e99e-4506-a47c-9ff9fe00a14d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410563, "uuid": "16c317cb-b0bc-405b-a2fb-92f20022ff91", "value": "1FINAL REVISED_INVOICE AND PACKING LIST FOR SHIPMENT Email no. M1053 dd. July 20, 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27549c7-eedd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627392151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392151, "uuid": "4d670c0a-ed2f-4617-8fb4-49c186df91a4", "comment": "Malware payload (Loki)", "value": "1dffded46a39053ed2e4c5d178cb1a87", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392151, "uuid": "d71db385-f988-44b4-9576-ee05f9772b01", "comment": "Malware payload (Loki)", "value": "3964f3eb14c348d5578e1b758c9cb25d792aa287c24b57f8371729996dc118fc", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392151, "uuid": "04db1f02-89de-4f74-8154-e141384015d3", "comment": "Malware payload (Loki)", "value": "51fb859291867bdba9dea197f4788f8ffcb76f8d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392151, "uuid": "bbb36561-316b-47bc-884b-aca9fc67ed94", "comment": "Malware payload (Loki)", "value": "1fa5198bbe276038187dec9a26f7d5225ad6ee454ec1703fa7bd428df2bc1730a819ac286f0a455d23a51865d68903fc", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392151, "uuid": "e737aeaf-9729-44af-ab14-b1b340d70bcc", "value": "T1DB451203DD495E83E058C3BCBF5B0EB5574E625EE892BBEE14B24CD76F542520E8B068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392151, "uuid": "936d12c0-8827-4670-9b79-bbfb34016f62", "value": "24576:lSXaEIJoa+8vdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXVaTsGju1h9FvQuWHKuRSkU:EXaEta+ipju1h9Fo1Sk3yq4Sf7GmMEvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627392151, "uuid": "df1dd64a-34e2-4c4f-af47-b704824579e1", "value": 1199801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627392151, "uuid": "d294b03a-c377-41a9-a67a-fffc008acda2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392151, "uuid": "bc8db02f-ee02-463d-9e0f-396d5d03a5a5", "value": "Invoice_PG_008946.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c6e0ca-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372267, "uuid": "f0b056f2-daf8-440d-a530-cc448c648e8d", "comment": "Malware payload", "value": "a0a0a0c638e1b7f7ca462dfaeecec583", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372267, "uuid": "3b1f0c7d-bd1f-4fcc-a54c-b3117562f4dd", "comment": "Malware payload", "value": "396a5a5fd3cb71cf8df3e49d94e3245c45113457c512db243bf95248e3ee2d93", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372267, "uuid": "2ff28282-ce9f-4ae5-9c28-3943796a544b", "comment": "Malware payload", "value": "b713bfd38a01cfc7a5945eff4ebb2d0e19e380a8", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372267, "uuid": "baac8be9-8bdb-424a-9630-a08ecd999468", "comment": "Malware payload", "value": "4bb9be1683186d6e2ab96f3407fbdc4caee91625f6ad1afa549f0db03bcdc477db163286f5cb9fecb6636ccc6651d9a6", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372267, "uuid": "aaa10c94-8c32-46c6-a6ef-bbcee9531f15", "value": "T1D945231C3CC20F9BE5FF573822E795C1C6AD6CB9A641A0B270D83752B4F29E11251B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372267, "uuid": "4a3723da-ff5d-4673-b8d5-ebe5be84f371", "value": "24576:2WkWUO/zfr1eCdZ+2yuwKicbMTgdQG1IJ3SPTEKTsYJ0:2WN/jJHqRHg503QQKTdJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372267, "uuid": "55678857-b722-4c55-8d9f-ade37842a057", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372267, "uuid": "f7309e94-2a51-4f42-914a-9e5c5ee9ac39", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372267, "uuid": "521ceb77-a606-48be-9ba5-d30869e09f2c", "value": "P_Order_Doc_KBV902G ZE3329.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2e6811-eedb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627391065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391065, "uuid": "edc9551f-b2fc-4550-b3e2-4e48cddb8c4d", "comment": "Malware payload (AgentTesla)", "value": "1559eb5515eb732de889dcdff24662c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391065, "uuid": "1ec44799-06c5-444c-b23b-0432a0083905", "comment": "Malware payload (AgentTesla)", "value": "3984eb9bbb5210eaf04a4bcdfcc1512a58df9d264cf2e8a19377f59d4fd8e55b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391065, "uuid": "72baf8b6-7fa3-44bb-87fc-90317bb46348", "comment": "Malware payload (AgentTesla)", "value": "69abf00e7e4ab89a0592380413d3d12cfc714cb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391065, "uuid": "3d7c4fd0-cc98-4218-aaa7-11cc622d0606", "comment": "Malware payload (AgentTesla)", "value": "3e0f2075fd6357a166ee60a1e16ff51f24b5576045b422e8fb3878873c9c2c69c33e625023bc1a3f7f0e56ee677e5a6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391065, "uuid": "482a94df-2273-4fd5-b343-c71f45a9c755", "value": "T118D459AC315039AFD633D873CA64AC10FEA024A3A307CE079153159B5E0EA57DE5DDAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391065, "uuid": "ff35d24f-9920-4772-898f-6c7a74bc8882", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391065, "uuid": "f78b6b5f-4066-4eb2-895c-cb8ae5f29228", "value": "12288:z+IIs67xrXWxgxMdplNGvIcGZwwDVHJXuDzKYzIE5P/XiS6lYSz8uahDtbNL6WTW:z+PsGlsFGgcQDJJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627391065, "uuid": "8a7c525b-d4cc-4288-b73a-955e7a0074df", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627391065, "uuid": "fedc5f15-7b9e-423c-8824-beeee632cda8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391065, "uuid": "e3baae9f-65d3-4be5-a763-8a190a5e08b2", "value": "BANK CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dfef57-ef07-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627409929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627409929, "uuid": "4dc152c9-945b-4823-89f7-5ab00c0dacb2", "comment": "Malware payload", "value": "c253f7490b6837696d2a3108063b1759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627409929, "uuid": "704e10f1-d302-486b-89b0-db05acc703f6", "comment": "Malware payload", "value": "3989e4bbaeab65af22040deae65366ea0b0091b8baf47093fe8147a8eb8187da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627409929, "uuid": "32a930e1-d8aa-4109-b3b2-5f59c32a4167", "comment": "Malware payload", "value": "5e638bdae86a9fa81e53085f345c117a21510c24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627409929, "uuid": "8bc5e6ba-3959-4817-aec3-c20765fcd769", "comment": "Malware payload", "value": "364b96d2ff2eb7539ed7415833efb80ba794a1b8060800625af5d52285ab34fb38590a5ecfac02474f7ce238a2053b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627409929, "uuid": "b54b5510-0fc0-47f8-bd7f-e4c91f72f5e2", "value": "T1B8E4E069736BA308ED7487F91C66D1A2A7BFA02A616DC23C0E44C17CBD7377C2AD0591", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627409929, "uuid": "001e6043-933b-44cd-a51c-9ffdcc23aa0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627409929, "uuid": "46deacdf-2c3f-426c-b1e9-653aeba47ee8", "value": "12288:F2ByvUIZbVa4Sw9FoQtxNna84xo9k4fGH07cvxtr:Y8vDBajj0NnamGU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627409929, "uuid": "c1a4b9ec-9cff-4bd8-9291-b06feeacf159", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627409929, "uuid": "81ac38c3-e865-4230-83dc-9a5a37f02c69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627409929, "uuid": "98adfce3-d2f7-4ede-b712-9e0fe202f446", "value": "6ufxz8ps3Mbqhxn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9561ac-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1627366292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366292, "uuid": "cb77c76e-0f13-4ae1-9963-8a3ba15a9e65", "comment": "Malware payload (QuasarRAT)", "value": "59afe3436eee2e9f3c9a5556cf33cef7", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366292, "uuid": "4e64a745-74aa-479e-9154-163b8c372c08", "comment": "Malware payload (QuasarRAT)", "value": "39cd5c2dd4929b254d9ef4bf758ce2401e49fd5da55ae97ad1939db2cc3acdce", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366292, "uuid": "5fcccdc3-8736-442d-82b3-d0ecc084d7c3", "comment": "Malware payload (QuasarRAT)", "value": "43078f70d254753e59c8a920a7f27a1f5cc8e31f", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366292, "uuid": "ba5b0fa0-0cec-4f49-ab17-94a221991b1d", "comment": "Malware payload (QuasarRAT)", "value": "4dd04c14cf708f7b33fcbe98e780eaccf20574e66af520c3bb317e6b8d48b0113607a43a0dc6832762e808dde2451414", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366292, "uuid": "0ce441cd-5757-4652-819c-0530dfe88e22", "value": "T1DAA423F70B4DE351D6960243ABE3FAC0B65F71AA1C0DB9B6302A466F59BFC227207115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366292, "uuid": "742ad823-db93-4e2f-8261-89aa1395b57d", "value": "12288:KuL4A/KxFv2y8Ymc96MnWJVtayr0tiEyK7I/HDdn+gtfTg:KuLz/2FOrMnWJvrWiEv7e+kTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366292, "uuid": "f60baf6d-0f15-466c-b164-abca191e60e3", "value": 471126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366292, "uuid": "2b841039-edd0-4f18-9a9c-53f484b63069", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366292, "uuid": "f7fc1d9c-4308-49d5-9647-c0ba50ed6050", "value": "000100049000TK.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8555908-ef26-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627423595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423595, "uuid": "561f0c7c-ebe7-47c2-a729-3c6ed620a440", "comment": "Malware payload (AgentTesla)", "value": "b494cae2a5d2841dfc30166f2420b591", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423595, "uuid": "fe8ba6f5-2147-4246-8109-d59f5b776734", "comment": "Malware payload (AgentTesla)", "value": "3a121fe0868a35e1b49b0d37241d04bcef95d9b34bcd3b33736857c9b59c846d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423595, "uuid": "21b9e621-4207-406d-8923-511385f00e1a", "comment": "Malware payload (AgentTesla)", "value": "02d3c49ab6714d37974031ac5236b285a251668c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423595, "uuid": "963d02da-59ee-4975-8b8d-8f15905fdf50", "comment": "Malware payload (AgentTesla)", "value": "88195d75f6e2b2494a968fcdbde329c655dea530b1c953a130f9c4ea562f6dc8f95b3cbda4026fb8171f8ccac5e1a56e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423595, "uuid": "e37e238c-cc02-460e-8ecc-e977ca20f7d8", "value": "T1C5F4BD38559499AFC672E533C654EB00FEF259937232CD0A529BE6871F0B0035A9EF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423595, "uuid": "13a20ee4-9150-41c9-8420-2cfb7cc82897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423595, "uuid": "8d62808e-6a03-4455-9f9f-1a07f5ec3d41", "value": "12288:LA23l4+sIzBaz+dBDEGrmN2LA6CpXfwNZ2JuPDBrOkh7EKn:LAU4+WqdBDEGm2M6CdSZ2qlay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627423595, "uuid": "c17591eb-cf0a-4a96-bb2f-9c3676606b14", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627423595, "uuid": "a11de5ef-f581-4838-a45f-f46b6e1deeb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423595, "uuid": "a8cdc19f-3d05-4acb-a361-d8efb43afe57", "value": "Ref 4359-0201-106.034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab19becd-eea0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627365939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365939, "uuid": "a9659e69-8eeb-4d24-b0fc-0449b548028b", "comment": "Malware payload (Formbook)", "value": "7b2f837b3a3f8980901ca3a6f624d8d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365939, "uuid": "4742597e-a8d1-46ba-8a91-69dfcb780823", "comment": "Malware payload (Formbook)", "value": "3a4677dc6f14f38983af15458b11d5f92e71dea8d5cd0e5b263c50d211a72621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365939, "uuid": "10227ca6-38d5-4ba4-8554-e415c714eb4b", "comment": "Malware payload (Formbook)", "value": "7e0b1aabde14b6c64f8553d1d7e3499af79d2448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365939, "uuid": "cfb5216e-4e9c-4699-9960-2d50241773e5", "comment": "Malware payload (Formbook)", "value": "7a0e6c078efca461c04ab42bc40a75d5134557aa52e5fae58309159b6186ec8cf70b2ba960bb1d5ef7565f8ac788b310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365939, "uuid": "d448f60b-676e-4106-9575-7e0a0ee142e5", "value": "T165D4ADFC3539375FF49384BE54B45CA2696020FAC92EC792F72341ABEF0D49B9940692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365939, "uuid": "6d8b980b-c6f9-43a0-a081-84297979acdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365939, "uuid": "0645c44a-ecf1-48ec-b0cd-b8d54a025cf2", "value": "12288:4WlFlGQCylFMnDmJhLzyBCZr624/G+ro7mo5oFCEkv:XTbJQ4Lmc37mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365939, "uuid": "6e49feba-3091-44b4-bebc-a88f6d8396fd", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365939, "uuid": "6e8929e0-280f-4f66-93ad-f31cf12b3daf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365939, "uuid": "0aa360c1-eda5-46c5-8ad1-56675c3c3368", "value": "moni.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c02721-eedb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627391089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391089, "uuid": "44fb72ef-f944-464b-ae71-e4e7693332d8", "comment": "Malware payload (AgentTesla)", "value": "c25db03537a94168fe05f968720c735a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391089, "uuid": "023513b6-1ad4-4c59-afb4-670b0e3779c0", "comment": "Malware payload (AgentTesla)", "value": "3a94befc248570bf58be57f7b0e146985221219aefed7e437ddf865711b7c069", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391089, "uuid": "5671210d-b76a-480f-b729-6552cb2e6bc4", "comment": "Malware payload (AgentTesla)", "value": "bdf8b7786bdd448a689e06347895ca8dbddab79c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391089, "uuid": "f3664192-f017-4bad-a0fc-42d488891dc7", "comment": "Malware payload (AgentTesla)", "value": "baa4088c98e78cb23ae07474c1877b94d90a59e4b8f1794094f7fef9e8d7aafba0489264d3916d79955b99a4541fd1a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391089, "uuid": "c44ebd1e-81db-4a1b-989a-6c0853f90f64", "value": "T16AB48C3811A80A63F67AE2F2C565E200FFF056D3B241DD19DAD3A1CB1D22713659EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391089, "uuid": "c611d229-11d2-4081-8861-77a868b87e98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391089, "uuid": "79ca9652-a0b8-4aa1-a003-5f32f65d7ae6", "value": "12288:IQ+p9N1yyzzBDxIJhvSM2lLObiIxxx1oNApRgRY:IQ+9XMhvSMfrTx1oNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627391089, "uuid": "6d5b4bae-7b46-497c-bda9-99a7e95bdc6e", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627391089, "uuid": "6a2c05e7-c9b4-490c-beb3-b59fc09255c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391089, "uuid": "ab713cbd-86de-4be5-b886-c1c6e82ff471", "value": "Purchase - Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d01e9a-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401844, "uuid": "c9f5dec0-998e-4e37-9fde-3cf822d6463e", "comment": "Malware payload", "value": "e33ac82c14447959cb7aed86bd915960", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401844, "uuid": "17210653-a430-4671-8bfa-3ad503c92f19", "comment": "Malware payload", "value": "3bcc082fdf8172ec9014d27d75cd67698ac1f27228a698849fad2a56fe94ca0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401844, "uuid": "8229aac5-27a7-40a2-a293-71c6a86ff6f5", "comment": "Malware payload", "value": "9ea25902ed4f55813ae2708ce237bbf3b89f924a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401844, "uuid": "a5db05e1-5259-4c05-811c-ead0cdc35637", "comment": "Malware payload", "value": "e1f86867381d25fb66849261f71f105faa4a15a93c3d28773436571f7f67a5c5f3eb8ae53406bb60a29e836821cd4178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401844, "uuid": "45c7f953-9f7a-42ab-a25b-6950c22ca123", "value": "T1EEE4BEF93539375FF49384BE60B45CA2695010FAC92EC782F72342AAEF1D49B99502C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401844, "uuid": "6b12fdee-a3bb-4bde-bae8-cbeb4c34440f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401844, "uuid": "35fb7b38-6c3e-4188-95a6-a2c2bdf0fbcc", "value": "12288:2c/rYabLfcjjtwxeQPj/YISTDPEK9D8IjP4qFRz68DfeDWzEooHEQ3Y7mo5oFCEa:hfUijtaEUd1FVtb/F7mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401844, "uuid": "0fd9e019-6ad1-4fad-a4cf-72c122939892", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401844, "uuid": "81c89c82-586f-415b-965d-74c574161b24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401844, "uuid": "d25a41a6-59a7-4164-9736-d739775cc75e", "value": "e33ac82c14447959cb7aed86bd915960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9a986e-ef27-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627423761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423761, "uuid": "e291db39-864d-4483-b8e0-696fce5c8727", "comment": "Malware payload", "value": "03b78817cbff3cbd8688011c09f6dd1e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423761, "uuid": "775bcc4f-5069-4690-b66c-eb154d431bd5", "comment": "Malware payload", "value": "3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423761, "uuid": "723fcf7f-8991-437f-8b8a-60ac534e00be", "comment": "Malware payload", "value": "37b26787786368cd51a356032a2a7f6d86810a8c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423761, "uuid": "555f6eb5-666b-41fa-a260-3236a98388ab", "comment": "Malware payload", "value": "b6dda00242d63c69c3715280d97b7ead9855e4c53f87a7a09bdaa92705716ce4ec8798f4d1d33c20b6022feffb98970b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423761, "uuid": "64b2cfb3-4602-4608-a839-05acee9698a8", "value": "T18873480176D98271E0BF06760AB58A61077E3E21EEF68C973F81154E5A705D0AF3AB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423761, "uuid": "0cf65530-f326-49df-b074-87eb73128e0a", "value": "5b5386ff1ab8376ebc7395dca6854368", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423761, "uuid": "f987d447-a5af-49ee-92b3-85007785bb14", "value": "1536:rQ/jg1dLVwvOhTWdALQNvAc8KsWjcdHe1ZDy:r/dL6EXVHe1Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627423761, "uuid": "8d5d3b29-1673-412b-aefc-51b4ebf7b2b3", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627423761, "uuid": "fbca2ebd-d296-4727-a44b-fdf17d325b79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423761, "uuid": "6d2faac5-0261-4e67-8432-19533bd19203", "value": "3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1115eab4-ee74-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627346783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346783, "uuid": "35b14bf3-bb73-495f-bba5-091fa62ca2f8", "comment": "Malware payload (Mirai)", "value": "e20948d53fe6d7f4637d3735fd8cf9ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346783, "uuid": "11ba59a3-d3a9-409b-8745-2445bdea351d", "comment": "Malware payload (Mirai)", "value": "3c817b98ac794f30a7f124c81f1b223ec345d58c68fe8c7dcb9464864d89079b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346783, "uuid": "2996be8a-8b78-4914-a9b7-c727cd284d4a", "comment": "Malware payload (Mirai)", "value": "fe9309cae595b36ec3cac4932ae807c17cd4d0db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346783, "uuid": "0d66a079-0bb9-44c7-80a9-33ccaa87cb39", "comment": "Malware payload (Mirai)", "value": "4ef7a55a41baaaea7d9057bf5f56e2f185d817d8433d74ecf98d6e99ad2bef3889c540b96336b67a5f1301fe45960cc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627346783, "uuid": "8ca2cb11-d246-4ac5-bb00-d653fb89a418", "value": "T19E23A64A2E215FECFB6D863547B78E30938833D227E1D685D25CDE015E7024E646FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627346783, "uuid": "0ced6c25-76f8-4271-a51b-ef2e8a330f10", "value": "768:snzZhkG94s0bIWsRjnqn3ymRdUXYHHoLV+I/dA+e16dBL5qKHdEYHVyrs:uzZhjPpRjnG3ZSImx/dU1UrHVgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627346783, "uuid": "279675a7-4501-498a-88dc-7711ec5d3fcb", "value": 48436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627346783, "uuid": "c9ba8def-3b1d-4f73-a087-3cb396d81ed3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627346783, "uuid": "480478a3-03fc-44b7-96a6-585219d0ff19", "value": "e20948d53fe6d7f4637d3735fd8cf9ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429fea7a-eee1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627393681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393681, "uuid": "45b917ed-fe69-487d-b2af-093899fc7eea", "comment": "Malware payload", "value": "3a0cf702a43367c0e54dcd00d65eefed", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393681, "uuid": "578a8e0b-9550-4f74-b5e9-03329a0c884f", "comment": "Malware payload", "value": "3d69901e410d521fd39961a3809826a05fe689b5cbb561027d4cf5019d9ad8d2", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393681, "uuid": "0a608caf-001a-4588-baf7-bc39d968b4a8", "comment": "Malware payload", "value": "4bc5c915bbcab36b1a7cb3e1a9465d0d5b40b33f", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393681, "uuid": "e2e309f2-a1f8-493b-a981-b7af9555d457", "comment": "Malware payload", "value": "770c7b44f74f1a95223b1b6db582bec5fe250136f9c56b4896358e6a5064a66abaebfddbb3f69be089f7bbaf2638df7d", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393681, "uuid": "785f8ce2-3896-4a6e-aa3c-628837ae02b8", "value": "T154027D687FD198B5D14B4A74EA0A82C5E1488E0A9753F3DB332561FD0A61C0847E3FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393681, "uuid": "404cf4a9-4f77-4e1f-a193-f5ee7b1049cb", "value": "192:U3gfEJ3QVfPY7I7G6hiRNk6s7jMDhlOe8udNkaI2ojzd:U3gfEGNPY7I/OwcVAe8udN7I2Wzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627393681, "uuid": "1f6e0d76-87e5-465f-a992-db63e7660338", "value": 8449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627393681, "uuid": "98e8716e-6a9e-4a02-a0ab-f3571b75d8c7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393681, "uuid": "3d07f267-0991-40be-a52b-9dacfc948017", "value": "Lea.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9f333e-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1627400246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400246, "uuid": "5efa1d69-8fbb-46e4-a017-616e07376cf4", "comment": "Malware payload (DanaBot)", "value": "1f57b1bf29591b6cd4a7acdae635ff66", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400246, "uuid": "18e0ad81-ad63-41f1-939c-ced81c0230ad", "comment": "Malware payload (DanaBot)", "value": "3d818dabca9956696c7942d76c16c88ece6b74bd8c479ad4b5de31109e85c237", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400246, "uuid": "bffd4b10-ec62-4d1b-bea0-6519b8e2766a", "comment": "Malware payload (DanaBot)", "value": "c4fdd40ea7a9a35e8dbe2aacfaf1f3c872e8d690", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400246, "uuid": "a2935894-378b-463a-b25f-14d755b9491d", "comment": "Malware payload (DanaBot)", "value": "bda355ca0c0383f0fda5d18a902db77207057b358aa4930431ea89eff05f6371c9e96423236d498270ba11c817ed9288", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400246, "uuid": "9726afa9-b513-4930-83b5-af016901a561", "value": "T131451220BAA1C430E6B316F848B69378793E7DB19B3090CFA2E12AEE56741D4DC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400246, "uuid": "1749029a-c481-4dda-9bd8-a4f5efb587a4", "value": "ca59243ab9216853b8ca72d3a7c666db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400246, "uuid": "4b192750-e2e0-452f-a058-2e7acbe212f0", "value": "24576:SYOc4MasBAgN45LhIUEekqTCv3OWeUH4SA7rKBwG+qS6Qig/cwid3Ut:STg8hIek9v0UHrq+BqqS6qihU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400246, "uuid": "54867091-f9e5-47da-a19c-a6c7b3c91a15", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400246, "uuid": "c8a8d08c-6969-45d3-8a0c-e01fbe7806ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400246, "uuid": "f8c95a2a-fece-4b41-b7d2-bd3d7ec04ab6", "value": "1f57b1bf29591b6cd4a7acdae635ff66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6b6c25-eedf-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1627393055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393055, "uuid": "7b90119f-5797-4082-bc1d-50b0dad46bf5", "comment": "Malware payload (GuLoader)", "value": "1d50f83e3d813173ef100b3fbea88c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393055, "uuid": "bd21d322-6463-472e-bab9-168d5d40d9bc", "comment": "Malware payload (GuLoader)", "value": "3e79a34e76245c626a025065772857f692c1a413f6b2345b39b358fdb68f46bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393055, "uuid": "fe864cdb-4760-4f2d-bef7-d11f7cb25249", "comment": "Malware payload (GuLoader)", "value": "9eecc7999b00c62b8f18fb44fefd951ab4b8ad3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393055, "uuid": "b592578c-1b8d-4baa-a71b-971bb73f2dec", "comment": "Malware payload (GuLoader)", "value": "3071c77e2ede9c6bdcd460041de3883c562e8af0f589a4e02774851ca73c5005018689ff2a6939c908ade72b85b6444c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393055, "uuid": "5a30307d-b254-4a72-a26e-07ac3c288b22", "value": "T13F24163398288D14F524AD7F18092507932A3671F51D5F1FA229BBBCF2365E2D792BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393055, "uuid": "15f5a028-730a-4a50-92eb-56a666698593", "value": "986283b4a993506f83eb1b2760b4b2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393055, "uuid": "ab447335-f8d3-480a-9226-faf8af1d6df6", "value": "3072:nhKiUNKQ28oiKNHZYWT7Y27RZycTcSBfnu/QZUNMRh:QK/8kMkkMZhcSdu/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627393055, "uuid": "7dc6cfa8-c268-440b-873b-8c6ecf272686", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627393055, "uuid": "612e1f1c-9076-4521-8928-3abb8d2b1548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393055, "uuid": "bf5407bd-c2be-406e-8214-f541bfe05ead", "value": "SecuriteInfo.com.__vbaHresultCheckObj.9568.22398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2286f26b-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372153, "uuid": "11e8d8ea-2e40-49b5-8d14-04f4242d96da", "comment": "Malware payload", "value": "3c822f6bdeb2ee0a552a91dda99c644c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372153, "uuid": "e40826f2-3d22-479a-bfea-640c2a78b317", "comment": "Malware payload", "value": "3ec37a38b4c0b5d0817cfc4b4947e9dc16f283bd923cfb4e819cf826f37957c6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372153, "uuid": "7e924c27-cb24-462b-ab90-e7d259056e59", "comment": "Malware payload", "value": "41461992211084f1fcfd9192d07e184abb0adf71", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372153, "uuid": "553a40ea-6dec-4084-a61a-fc74a33fe49c", "comment": "Malware payload", "value": "5ff2250513dc5ba8917b2c002de780117e723ead81e203d75974ed91bc96e8b377bf35e65992724fd266247b05cf1f08", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372153, "uuid": "205058e7-5c5f-4d27-a2a2-e093eb4523c9", "value": "T1CA91E775E7480CCAEA6346F3C215BE5309A7F317C9C70E81723DDEB0076F1565AA2A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372153, "uuid": "f40ed1d6-8c7e-410d-aaa3-cf4442c850fc", "value": "96:e8T2ZJmBMoUsEkPdGuWsn8ceEA59ymuo5K9ZKsycfcX2XqaqTNdhkHG:eClBZEk0uWs8FEkuwqcGaBTNoHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372153, "uuid": "1dabe234-270f-4076-9585-07634532645f", "value": 4499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372153, "uuid": "a48d5dd7-5338-43fa-a6be-d2f180e0663e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372153, "uuid": "c4c059d5-5bb3-489f-9730-db29d41f2e0d", "value": "Request For Quotation 14000145971.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e041ed85-eec0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627379772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379772, "uuid": "3d39cf13-089a-46b3-8636-f221fee1506e", "comment": "Malware payload (Formbook)", "value": "d90d38f2dc39b8b19368a55a44841fa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379772, "uuid": "2753c694-10eb-4ed4-8372-94f29a8728fa", "comment": "Malware payload (Formbook)", "value": "3ede9e9bdf0965f93b5351cc4be670b30934bc39aca24a3f3ac5f245f47c5073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379772, "uuid": "efbfcb55-7bb6-400c-b38f-11ed01e97765", "comment": "Malware payload (Formbook)", "value": "971a1b851d914a17b97cdc95c17fc7d3f962c009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379772, "uuid": "c5283c99-a703-4a6c-b025-29bec7a3913d", "comment": "Malware payload (Formbook)", "value": "1be1739763b1d3d687673b77af705c9b40383b582be85724787b6b6dffde5de03a058710031dcacec15a27e652d7f6e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379772, "uuid": "1070b323-80c8-43af-b424-00b094fc8314", "value": "T1E69501F5162C7F1BF0AF1B7D906140229BF0409BC96ADBE4FF6614EAAF242975052286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379772, "uuid": "9130e826-92b2-4c89-9679-579ee43bf338", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379772, "uuid": "f109a83f-303d-4e70-ba7d-5e87f2113f61", "value": "49152:q8pmoHM0rFHOtzfArHR19OZ2f1a8+VzKroYrgLExfT4J9:q8pmos05OhfA7bcgNa8+9KrqExr4J9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379772, "uuid": "a1d83308-a17a-4f67-bf0e-1c03ea7b9be2", "value": 1920512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379772, "uuid": "4dfdf913-e4f0-4a07-9925-22e2bbad4e17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379772, "uuid": "0617c330-9352-4378-a76f-bdba30a867f4", "value": "IMAGE00037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be06198e-ef03-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627408491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408491, "uuid": "8181367b-507e-4e21-a614-9518867755a3", "comment": "Malware payload", "value": "165bc8a39139125af4c0d0a7c7301d9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408491, "uuid": "1f53167b-a6f5-43d6-ac68-a392a43c9363", "comment": "Malware payload", "value": "3efc457bcc114f42630bd1f3c0ce8c6552d1af183861d8c640428ca527e6dc6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408491, "uuid": "56c8085c-aef5-418d-bd42-30448629bb3c", "comment": "Malware payload", "value": "8e93cb2c2b7be31df379ee61f594955f8493c12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408491, "uuid": "73d74ce9-ae98-475c-b61c-eba2f682441c", "comment": "Malware payload", "value": "3e07bc8b946a8b3922368006e5063de1ebd4e52de49f9df1cc00f4bf3e2d588e038d9a7a8e01d242fdeac18f01375b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408491, "uuid": "9b98282a-1cef-45a3-b432-fd24a694f82b", "value": "T18A734B03B4D298B1E5B61E315870CAA06A2FB9111E259FBB375406B90F344D1EE36F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408491, "uuid": "f889be8b-6282-42ea-96c0-f1bb7b27a8ff", "value": "1f0506b9dc2df731e419d48595d4aa6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408491, "uuid": "b2cfa508-4adb-4fa5-bdb4-7b1a6f613957", "value": "1536:JpNjdKBJCOBInhvBu/ts4e9y0hvj/ulqJgsWfcdW8Z/J9t6Q:9dMtihv4ls4eY0qCTWm/Jn6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627408491, "uuid": "d9a68868-8d12-4592-bcfa-8cd7c59500c3", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627408491, "uuid": "a12bbc34-30ba-4ea7-b1e8-8873f25bfcf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408491, "uuid": "bb0a968c-1621-4037-af79-8eca3cc01776", "value": "MBROverwrite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb0aff1-eee3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627394696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394696, "uuid": "a314d3d8-4d95-4062-a535-be7c4bcaeea2", "comment": "Malware payload (AgentTesla)", "value": "e7e6dd904cf4e8914173e3c1144d457f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394696, "uuid": "0b8a2bb4-6fbf-4a58-8f4e-1ed5bc46e9ef", "comment": "Malware payload (AgentTesla)", "value": "3ff843810cdddb3d63f8c88302b5b37293a28b5bdd5d71193851c312d2abcd28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394696, "uuid": "291db7ed-b806-4f83-abaf-f6f28993bc65", "comment": "Malware payload (AgentTesla)", "value": "da2e7749856bb874dab798c6e73d643f2751250a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394696, "uuid": "17b63469-654a-4aad-9c10-6dc5ac440541", "comment": "Malware payload (AgentTesla)", "value": "618c8740c7ecdbab1d863b31bbec847faee149f1592a51ca14a19c6359fdecfd551704b538b2bb0e35c5aebe47f35410", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394696, "uuid": "15838c54-f85d-4c46-9c11-f23ff1c5ae74", "value": "T1F6357C10236B5F98FC3EA77A2038004057F5F80BD32ADA0D7EE650DD1661F968AB6B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394696, "uuid": "ed075f91-9af6-4be0-9bba-f07bf6dc11e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394696, "uuid": "a6378210-557a-40c0-9637-f573016e2d6f", "value": "12288:vzprQz/MpI2HwUTB+3yvUIZbVKpyKWyKpMI9rWMaNeFRp5hoNfLUzIbGrEu8CliN:JdsivDBERKfaUv0fQFwu80iN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627394696, "uuid": "a01acb8e-8262-4416-abf3-fad619ff184f", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627394696, "uuid": "48c02324-309f-4788-961b-18c37b649297", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394696, "uuid": "39002c54-347d-4eb2-8775-eca7125f2941", "value": "SWIFT_987867T8E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc83b36a-eea0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627365995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365995, "uuid": "4b5748c8-0b2b-4234-a566-be8ccd7de55d", "comment": "Malware payload (AgentTesla)", "value": "fc0b0215e0ec8169fcd6556e236302c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365995, "uuid": "058a4263-f197-4ca3-b9d7-ba5577f45e0f", "comment": "Malware payload (AgentTesla)", "value": "4012c4289aa953f24fdc7e1e257f2d9b04f835a8d6bd1b8eb919271c46a7db62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365995, "uuid": "ac3513f9-a9cf-45dc-ae65-9417908b4ecd", "comment": "Malware payload (AgentTesla)", "value": "e7b965067c6b7be5e24ad284562a9bac91e591e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365995, "uuid": "f9f8d484-e875-4cc8-bd89-da137177fa9d", "comment": "Malware payload (AgentTesla)", "value": "a41fc46d385c6408fb7152f1d45cee178bb922b246f136f27e7f4d8ca71e8eca02f27d02712d8f45bbd8662e92499d56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365995, "uuid": "0e2bd2d7-a86f-4e03-b5fe-4519f6507ae9", "value": "T190E4CEF835393B5FF49384BE15B45C6269A014EAC92EC792F33341ABEF1C48B9940697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365995, "uuid": "9ed115f5-4160-42c6-8bfe-f90e0d4b0d77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365995, "uuid": "edb9ce97-3d33-490d-8801-037a7e1e34d2", "value": "12288:LkHT8RQ5lnZK2iigFiJYPv2Pl/IEQJVEA8Dj5OCDwivJ5BVxgvGowebSSzpUmcFY:LkzIQXnZK2iiI3iIz3Gv8MvJM7mo5oFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365995, "uuid": "c94e137c-6b9a-4cd2-9ad2-96f902ea3f87", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365995, "uuid": "a180c87b-5168-4e65-a91f-327332bf7bfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365995, "uuid": "9fd946d1-4637-4b5b-b68f-a456780f6c40", "value": "invo5514155.pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eca438d-eefb-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627404815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404815, "uuid": "15a68056-85cc-482a-b8d3-9c8e9297430f", "comment": "Malware payload (Loki)", "value": "7b45379baf38ed592b3d16b792069457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404815, "uuid": "831ed945-434b-47d3-9de4-bc00c0834c8c", "comment": "Malware payload (Loki)", "value": "405d71e7cb7e41da021090a5859e5d69749d878a6c48dc689d690a3e4ff69ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404815, "uuid": "1e29de8d-037d-4ce4-86b7-a9758268c543", "comment": "Malware payload (Loki)", "value": "77d9577fc4b0956e04b6966e361e40566e65fb49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404815, "uuid": "3c299f20-1219-48e1-9067-bfc19ac6bfce", "comment": "Malware payload (Loki)", "value": "f66a25c49183fc04d4c5159ee0c5d0ee48c520f4b9d06030817db7d786eafbd6b5141b3bf4dddac89b25ee3c24e15155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404815, "uuid": "d18ad64b-785e-480e-91af-01f9d8c20af9", "value": "T1DD05E1263227A214DC38C7F51C64C1B16BBEAC2A562DC2782EC8ED7F7D7267D5AD0580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404815, "uuid": "7200dfaa-db3c-4466-9c21-86728f5687e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404815, "uuid": "f9311045-69fc-4f54-8a26-4f59c490d94c", "value": "12288:Fu1syvUIZbVlBPI2VBPhhHd6LKCqHBdWxWhYrkn79YKQr:FivDBlBPIOBPhh8qHBcrknOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627404815, "uuid": "39aa3970-9cb9-4fca-b96f-3a7e3c72fbcf", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627404815, "uuid": "48f59b28-f2e7-4b16-a0c4-609d31146c97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404815, "uuid": "950c1461-00dc-4c3d-97ac-8bfbb39b3b75", "value": "invoice for your ref.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73164ee5-eeb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627375294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375294, "uuid": "d5f97956-9be2-40b6-90b9-4e6a14c66818", "comment": "Malware payload (Dridex)", "value": "50269b5e8f60e3847888544e68368f3c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375294, "uuid": "52cbc2cc-da7c-4d93-a1c2-833913ef6f34", "comment": "Malware payload (Dridex)", "value": "40b5ae97c036d45073b6edfcabbd4f5fe1a577d2e21f57282c09ebe2d32b7492", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375294, "uuid": "dcfd9c04-2e10-40de-970c-f13ebd95c569", "comment": "Malware payload (Dridex)", "value": "3b8d2e2087d1936a6dd08013ef1c8a344dbc3515", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375294, "uuid": "6715ebd9-388f-4e89-94e3-5cdc8fac12f2", "comment": "Malware payload (Dridex)", "value": "360a6760d64d9dc3edba536f29d6f52b6d08bea9dbde0fdc7c6ffca54cb9fad19694bded183e582737f57956ca13694a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375294, "uuid": "15d35713-f52c-4572-ae87-33dc1b1c628a", "value": "T1EA73C0968E80674AC3F12475C304E6B5682E70272B73D5FA4C66F39D005DFB169AA437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375294, "uuid": "a79dc29c-e1ec-460f-8162-4aae30a3f505", "value": "1536:RjC5MWvBAnlcy6xQjqbO1pr7TOEgVbcWV6ZPEBUBI8aKLzrGAN:RjLNlctgqCPrfOBlcDCBUBIuLzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375294, "uuid": "03cf6880-d21d-45db-b83c-b7d308b9e69e", "value": 74634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375294, "uuid": "3468945e-498f-4296-85da-17704dfd0671", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375294, "uuid": "45496fd3-87fb-49dc-9550-b4c8d5ccc6b2", "value": "Invoice_41292673.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6ef0ed-ef11-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627414210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414210, "uuid": "4627a192-ba18-48d7-9938-8f5db80674ed", "comment": "Malware payload (AgentTesla)", "value": "fe61f0a471b697d0c381c64eddf3649c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414210, "uuid": "09354a20-bc3d-4001-a442-91d27e94495a", "comment": "Malware payload (AgentTesla)", "value": "412991e242a1a3b4325e9d22e9158880214f13fd0db68c8509fab47d4f09c9d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414210, "uuid": "23505a5f-9a72-473d-a589-0d103a0abae0", "comment": "Malware payload (AgentTesla)", "value": "bb8575caccc983a10f86de8c86e5e6598b993b27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414210, "uuid": "e154751f-bc82-4227-b4e7-7d5c0827e7f0", "comment": "Malware payload (AgentTesla)", "value": "fe087162d84c1cddb6b7b0c6f36d34dd8032079c67e6a3482fd54443cd0ca841ba2ca5adecb6af7949cadfea1037fc20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414210, "uuid": "346d47c9-a849-44a6-a5cd-be7114809585", "value": "T197B4127237697E9AC3FD0FB255F30E406EF02283A11BF6EC98D552AF9253B441B12426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414210, "uuid": "84cc9e55-d071-40db-ad44-d6930260f5de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414210, "uuid": "31e0c563-683d-4ef3-b448-6e721ab591c1", "value": "12288:eTYdWqKe56kKpZ+3xD3hChVBeuQWNXFJ3X2vDIF5:WkgZ+thqtQ6XFJ3X27u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414210, "uuid": "cd6e80ac-d5d9-4e8a-b884-425b1d2f5e7c", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414210, "uuid": "f1415d8b-a596-456a-90b4-9530139db272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414210, "uuid": "d4e0f91a-f58b-438e-bad8-bbbe89a2f36d", "value": "$35@@#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ceafb0c-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627375660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375660, "uuid": "8627e478-dc56-42b3-bde9-c958238cb7d5", "comment": "Malware payload (Dridex)", "value": "643490e54bf3f8046fdc3291706c731e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375660, "uuid": "e2398f92-beba-443c-bc4c-927343214d2c", "comment": "Malware payload (Dridex)", "value": "438c66fb365afa484518a37f4c1ad95b9d5d4990ae6e84d3a3609dcba035a415", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375660, "uuid": "4e39a34e-a425-4c71-b153-20525f9c08ab", "comment": "Malware payload (Dridex)", "value": "f3fe8e21c5e9037030a956ffe694967336392f48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375660, "uuid": "82f1d63c-e68d-44ab-b1f0-fddeb64bb948", "comment": "Malware payload (Dridex)", "value": "2034614f6e08990e1f21db43b923e2883e3415d929902ecb319eece784049c2b7de9fb96c43323f178440ffac387f945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375660, "uuid": "2e72de91-afa6-435a-bb1f-21d27ffbdb58", "value": "T1B304CF51D2DF2AD9C41E87BC11947A0976707EC2CB68C078E26AC4BCEF7BD4649E4326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375660, "uuid": "0104eff3-67a2-4ccb-bf6c-e0eb938f6c88", "value": "038ee71bd4ea63acaf586d3475ef17a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375660, "uuid": "892811f1-4692-4cfa-9c07-8973694c954c", "value": "3072:Z6Y5bY8XE+kkqh84cKcv4FinaLzL2rVQLOmpvNbTAvYstOr18T:cRAkkk84e4wne2nmhFAvY4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375660, "uuid": "fbadce17-3fe6-4cee-8bcb-e2feb759b5df", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375660, "uuid": "6efdfd8d-e786-4b74-baef-d42ef161bdcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375660, "uuid": "f142b803-260d-4eaa-adb9-fb5da5307289", "value": "643490e54bf3f8046fdc3291706c731e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f2e5e4-eee5-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1627395677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395677, "uuid": "1b0ab2e1-2af9-4dc9-95a3-917254e9f0f0", "comment": "Malware payload (RemcosRAT)", "value": "9c26af04ea48f7d88b95a286c66c3f00", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395677, "uuid": "fe21740e-4fc6-4b7e-962b-6fb27ce4f1a3", "comment": "Malware payload (RemcosRAT)", "value": "44064d93545f38520fcadc58302473ea99087deb716b245fcec3d3bd78b9ba34", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395677, "uuid": "e128ef48-1f35-4002-8081-ec341eb4ec68", "comment": "Malware payload (RemcosRAT)", "value": "eaee1d09024ac079821084d7c19de6347e10232f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395677, "uuid": "6795acce-7bbc-4c4b-bc2d-a9931718f2d6", "comment": "Malware payload (RemcosRAT)", "value": "7c98dfdd96c7bf628379963a7c35ec5340f3975cca9cb5b75df575bbedfd028baa7e5cc992cdb4209be9daf9fb6cd715", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395677, "uuid": "3d712f76-a87b-49a3-986c-3623a39edf68", "value": "T12034FBE4688F48B2D2499C5E6494B145AE74FEE334C5887223AFD434DF5ABF29EC4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395677, "uuid": "3e7997a3-f4f9-4cc6-ba67-0cad1a6fe4c8", "value": "1536:iqW7qA4b64PVTDuhrNnlwrnEYo9V2A0RowKxvVCpBdzFz76mAg5eeVhMDw5wfLT:iqW7qA4b64PwvrgBdzFtr5RDAw5wfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627395677, "uuid": "4d780b63-575f-4cf1-bbe9-ece01d5fc8bb", "value": 234652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627395677, "uuid": "669b89ae-5cbc-4fdb-a903-637cc7ed0f12", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395677, "uuid": "a5c8fecd-be44-4362-8ca1-864832507bf2", "value": "FedEx AWB 8002566716536.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a103b2-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627366089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366089, "uuid": "b5282046-9cea-42ed-b4ed-865a2e95fa38", "comment": "Malware payload (SnakeKeylogger)", "value": "43bf8478bf2676d95193f62fde2a11c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366089, "uuid": "0d8f7479-0a63-4dc2-b92b-42b15c38eafd", "comment": "Malware payload (SnakeKeylogger)", "value": "45479517c35a7efb32ab28968deeda5e3926f06b81ab4cf2b7ab9a87f3de336c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366089, "uuid": "5f07437c-d736-44fe-b1e6-a7be44e0500a", "comment": "Malware payload (SnakeKeylogger)", "value": "9153d608d75978006c760e1ce1cc9599e336d711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366089, "uuid": "cf27bd67-a824-4066-bc27-c1acb5691524", "comment": "Malware payload (SnakeKeylogger)", "value": "21ed4f6e078dadfab30aa1498243a040694585c8647b4420eed2984340accbdcae61a269b9907290fe0d4d7813958572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366089, "uuid": "54971dfc-9fdd-4fca-ab30-46b955971b52", "value": "T115D4AEF006397F1BF0AF0B7D907140629BF0509BDA6ACBD5FF7250E6AF252A71052686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366089, "uuid": "d068949b-8a04-427a-867a-c645e34c98ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366089, "uuid": "1e13c5ee-cc2a-4cd6-9679-b3eedecc7e20", "value": "12288:dg0PU9XPU9qm6ScwMTBgOsBgo0q4wMLaNMCupuwgIXIFG+2ubqUcrm2MUUe:dgtBgOsBgo0q4wM6MCuLgrV2LmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366089, "uuid": "1363b9ae-5f58-4e58-9889-6cd03df0512e", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366089, "uuid": "8597a3f3-43c7-4fd2-b3ef-3854903c862f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366089, "uuid": "4fbc6d50-eb64-470c-a3b1-2e1bc3ca653c", "value": "PO#JFUB0002 4QjPQ2oE-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe7dc6e-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627375953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375953, "uuid": "5cec1039-fc9d-493a-9a4b-5c8175fe658a", "comment": "Malware payload (Formbook)", "value": "4d9f21a8719054ede23ff9a28900c56d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375953, "uuid": "0863fb5a-d997-47c8-bf7b-dcabb9b60a7c", "comment": "Malware payload (Formbook)", "value": "46241be04eb48d9eed1aeb8a809f8baeff44cc73c5e533ab1d266f5f1fcf275a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375953, "uuid": "9ef199e7-8f3f-4580-b79e-bf94fcf9d3eb", "comment": "Malware payload (Formbook)", "value": "2c67a8afcecf4e9591592761aeb13ef02cb42252", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375953, "uuid": "8198f987-85d1-4630-9a5a-ae8bd7b74c6e", "comment": "Malware payload (Formbook)", "value": "3c7e22b7178dee16c18e5781ddf89132588586a27c8d19a66d03b06a7c4210cfc64876df77c63538e63819be16fea5e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375953, "uuid": "08249054-2179-4093-9936-4e9104d76e94", "value": "T13155BFB10919EF22F4B706BD74725A5442B48D46C96BCB68FE7332ABCD70FC23456A81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375953, "uuid": "3ea62b4f-2af5-4f71-a155-81b397876ff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375953, "uuid": "2c528b31-4b1f-4370-bdde-5f0d6b027601", "value": "24576:0BjeOsBgo0q4wMUBmCmTOUd+L6kdXWgRLSxbagEWnIHJSqeFf:0BjnoHMsmCm6Ud+zdXHRmbagE1pSqQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375953, "uuid": "866de705-89c1-4e75-95b4-b94cb41d27d6", "value": 1284096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375953, "uuid": "86a9a37f-d98c-42d9-ae06-32adc53820b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375953, "uuid": "1a3da9c5-7b08-4a7b-9278-2c20490cfc61", "value": "4d9f21a8719054ede23ff9a28900c56d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a751f32-eef2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627400915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400915, "uuid": "a4369c48-a8da-413d-9825-6ce104f34f80", "comment": "Malware payload (AgentTesla)", "value": "2553f424ecb8f9a07e4d4fd110adadcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400915, "uuid": "c87bf2ea-ce30-44c8-ab4c-f08b08f3b525", "comment": "Malware payload (AgentTesla)", "value": "49410b049129225af89fba012073e14ad171e27924af79e0d79bb60191e81f33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400915, "uuid": "463bb08b-93ee-4bc7-ae06-7d92e2693f86", "comment": "Malware payload (AgentTesla)", "value": "c82344a66717312df4ce2f126c5912b98b1003db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400915, "uuid": "1b432d23-775b-47af-9ea3-c87e17676bb4", "comment": "Malware payload (AgentTesla)", "value": "d5f820bbb5fe269b291d15f57a340f9d5c62f175f033d29190b94061796c62f7a2ed06a56a4211d8c51a25babb886e52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400915, "uuid": "6c9415d1-9ac9-45d3-971f-a5bde640b923", "value": "T18EA4233023C0FD55C6388B35B06FE618EDB2D7B79D4AD16AF28503CA7752B01CB66A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400915, "uuid": "19efe7ca-0fa9-4d9c-8c77-4e48fdba170e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400915, "uuid": "18745a63-30ff-41d5-82ce-4c6579aa3fed", "value": "12288:aPw/DQB/z3o3o71c8qt6UbtYzKcYMKvE:a+DgLdpqt6FWcbKvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400915, "uuid": "357b0dcf-8f39-417d-bf38-8cb92b5d7ff0", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400915, "uuid": "18c1067b-0530-4cf7-8846-9ef6f3778a2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400915, "uuid": "cca190f9-f5db-4493-8038-2696c018350d", "value": "2553f424ecb8f9a07e4d4fd110adadcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f84696b-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627400226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400226, "uuid": "2eb0bb09-2338-49c0-b1bf-618faa88dfa2", "comment": "Malware payload (RedLineStealer)", "value": "c5f656e37e0f79c1d657fac79c0dc6f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400226, "uuid": "b6f2319e-49d8-4ffe-8296-21ee8fc331a9", "comment": "Malware payload (RedLineStealer)", "value": "4a366034ebd2de1c9b6a13b215a82d56b31c0ed5f6162edc55b11084b69d1e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400226, "uuid": "91c50b66-0f95-43d0-bd19-c4229a2b4a40", "comment": "Malware payload (RedLineStealer)", "value": "9f8ea43cff55f791bc07b54831db69ff8e538536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400226, "uuid": "50d4975d-fdb3-449f-8f3d-0c6633408062", "comment": "Malware payload (RedLineStealer)", "value": "78b2f5c6f434c80a9fbfed075cf5ac8daa3d2f34ed3a2c6a036d74550871cd7628440b92bf9065d6a072766935df96e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400226, "uuid": "a63511f0-1394-4d64-abf7-d361e2735074", "value": "T177E4E030BB90C435E5B211F819B983A9A9397EB1973451CF62E13FEE5A346E1AC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400226, "uuid": "912cd53a-6a3b-4c6c-a714-9b8579034956", "value": "cd8b6907b5cf87baf066346ab3baafdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400226, "uuid": "913cd53c-46bd-431e-b6c7-dd3b0af6c27c", "value": "12288:2H1sUnbqy0oJrJCGgmuN2K38rVJEdi3Avxi2uatFIAkjYR9QwPY0Mg1Fa7q1g:2GU2y0CrC2K3OEgAxEGkjYNZzJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400226, "uuid": "149b8148-2d3c-489f-bdc0-cb053dca0edc", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400226, "uuid": "928cbadf-7098-4159-9bf9-23dd36ff7a9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400226, "uuid": "f7ade021-8496-428b-b522-6513d05ca670", "value": "c5f656e37e0f79c1d657fac79c0dc6f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a0fd04-eeb8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627375971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375971, "uuid": "da8108c0-6369-4c76-875f-8607474d3ee4", "comment": "Malware payload (AgentTesla)", "value": "93f1feffe4a797163f55f1caca45182a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375971, "uuid": "cb3d4170-8094-4e1f-b028-4b5ae6e49ff8", "comment": "Malware payload (AgentTesla)", "value": "4afaa463a048f9c89866a9c7154bf4a9d20ed849cdf6a8c0cf4b0b8b105d8e3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375971, "uuid": "aa38dd16-8e13-43b4-a6d0-f23ee8934cd1", "comment": "Malware payload (AgentTesla)", "value": "6cfbf536209e0c0256479785fec1ced9b2f77a11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375971, "uuid": "bc9485b5-863d-4bdd-bb4c-0a0f8f5e029c", "comment": "Malware payload (AgentTesla)", "value": "dcd7d4b5f86e37e891b2a6bd5eb277d42ac8b553036a5011aeabc0145008f8a4d7d097cea442823cfc676bae33b9e9e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375971, "uuid": "9b07be7e-b383-4e42-b520-0e05268d90a5", "value": "T1E8059EA97349BBDEE2196E39C51F0E44E3F2C1276273F68B6AE499D01530B06DE1F142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375971, "uuid": "eafc4465-0e53-4847-b2bf-cbba19ec1987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375971, "uuid": "bad9b4bc-815c-4536-91ae-f86cc8c1ca29", "value": "12288:hvfwVdEzD6tp2zNaOgKJfcJwaw8kt7V9qvhqbiB4gq5:h9Cva2LJu8W7jqgivQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375971, "uuid": "06367909-6cb2-4bbc-85ff-a610a000615f", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375971, "uuid": "1b766a5b-e009-43f1-b3df-b797aaeaa9b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375971, "uuid": "e8b4dffc-8700-4cff-89c9-36a0eb144bfd", "value": "93f1feffe4a797163f55f1caca45182a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b311537-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627384810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384810, "uuid": "15829865-ed8c-4fbd-b80b-effbbcb293e0", "comment": "Malware payload (AgentTesla)", "value": "df153c9600eceb8c6f27a0ccdab8e964", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384810, "uuid": "0ec4379b-5798-467c-81ed-67aafa73bf3d", "comment": "Malware payload (AgentTesla)", "value": "4bae6c537c27eb6acbf3a7e1607c72ff4485b44cc62f17283668ec849d1cc740", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384810, "uuid": "ff169705-613e-48ea-bbe3-c849049b9f75", "comment": "Malware payload (AgentTesla)", "value": "eada4abcdc29f74556c9234c2556be9d96576d45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384810, "uuid": "664bd2d4-7136-423b-ac3c-2b8e64a6bd97", "comment": "Malware payload (AgentTesla)", "value": "5324df448c822ecfe0505f6be089b1d27184da10046afb9f8174a23d8ef036cc8bdb993bec5ad1899b4a2515afe6e9d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384810, "uuid": "262f169f-1174-46af-9c02-5f8cf23bed40", "value": "T112B4238CA6CBCA738154298A78A0366ED23F347E4F15B11CD37663F8D5D4C2A9C47E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384810, "uuid": "eb530e44-b1e0-4e16-bb4b-9d62ea35fac4", "value": "12288:CNSPEZP6q2OCL3fnsPVRTGNDJ7UhKh/NKhYwzlpjh5u6:tA6quvsfTs1Kh3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384810, "uuid": "5c0a360a-48e1-4c59-9054-da81c863794e", "value": 516552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384810, "uuid": "1a4f4c39-d2b1-4010-ac77-f4d55d765cba", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384810, "uuid": "ec41dde6-d7dd-4dd1-8aae-44b0bcd7d030", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32079883-eef8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627403532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627403532, "uuid": "dfc837b7-8670-4ea9-a711-5e987cfcfd89", "comment": "Malware payload (AgentTesla)", "value": "a389a70b3f57c6a0f694f5b0cc64908c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627403532, "uuid": "17cbe188-ae16-457c-922d-5a05d50f4365", "comment": "Malware payload (AgentTesla)", "value": "4c24bf984c2fe0d3a193b0e490201800ab6eec8b0320c3ecb061512e21a4e833", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627403532, "uuid": "43200f32-1430-42bb-8172-14f44b7be4a1", "comment": "Malware payload (AgentTesla)", "value": "403ebc85552e19bb25ace57d45c7121ba5447b80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627403532, "uuid": "a0ee559a-aaaa-43ff-99c3-a560e82972c7", "comment": "Malware payload (AgentTesla)", "value": "26fb90e139d515bd245eb753e667abdf733b1d4e0a13c7867975adcf0c629701e0e70e538c78c2011bc6d333b6a4023d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627403532, "uuid": "468561b4-f1a8-4fd3-99a6-ffb250141add", "value": "T15223A614430D5921E3374FBE824B0A811BF0717321A6E97E3CEE66E5DDC29563E293E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627403532, "uuid": "b193f72d-fec3-45b3-ad21-398cad71d84c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627403532, "uuid": "9472cea1-9489-4b69-bc44-5ccada960a25", "value": "768:VHJ2yYa8XD2u82UG4Kxsmbnihddv3oRhJTXt9AEbqbMuwCnQAsIlhv:VH4y7XF2Rvjn938vvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627403532, "uuid": "90e22e2f-33cb-4746-94b8-bf2cc5138a89", "value": 49440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627403532, "uuid": "1096d6ed-5979-49a1-b4aa-00f6cd257269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627403532, "uuid": "9123ebbf-6b24-4119-91c3-23bd61c3fbee", "value": "Attached sheet scan no 77110016588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c799260-ee74-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627346775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346775, "uuid": "6812c98f-56b3-4255-bbd0-5567881a48a3", "comment": "Malware payload (Mirai)", "value": "a48cd2976dace76d869b9d6bad8e9bb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346775, "uuid": "c5ee3948-8e58-45fd-a505-464d2b2284e4", "comment": "Malware payload (Mirai)", "value": "4c5c3f23b0be56a521ad3c65504e921afb6390d6b0d2bbc0fe25f175c6c132d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346775, "uuid": "c6954486-b7a0-4798-aacf-b693b552efc0", "comment": "Malware payload (Mirai)", "value": "d5483be6cf5d9e6af56e18110226848a580f6f59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346775, "uuid": "1c0abbb9-7b7c-4c63-a648-2f36621f4e59", "comment": "Malware payload (Mirai)", "value": "840d4fb446adb83d442fd744da63b3921c6faca5b079271981d19197855009bd4ae6810b9a8f6d30980ca97fc5161d6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627346775, "uuid": "a7ad0519-80b0-44ca-937a-d940819ceeb2", "value": "T1DDE23AC0EE43D8F5EC1506B46137BB769676F02E187DEA8BC398E531D8A1941E2073AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627346775, "uuid": "b12450ec-f422-4170-97dc-b54b7ffaec48", "value": "768:cZiOOPDkiHUrPI8mwkYeqrT7LzFBdykijjpqnTTxC:lOUHUrQ8tJPTnFvykiHonTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627346775, "uuid": "ba9a22e4-ae2c-4a14-a7cc-46f0c6341ec9", "value": 33896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627346775, "uuid": "d21b655b-7baa-43a3-b983-c73f6e6471f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627346775, "uuid": "d2bca214-d98d-48e2-b294-519c94a36def", "value": "a48cd2976dace76d869b9d6bad8e9bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066f95b9-eee3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627394439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394439, "uuid": "4ebc3517-0edf-4152-8d92-ad4f1b048efc", "comment": "Malware payload (Mirai)", "value": "a532dbe14fcd7bb5eaefd54424dec4c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394439, "uuid": "83bfa8f5-7412-4de9-a9ce-f804db3fa4ed", "comment": "Malware payload (Mirai)", "value": "4c7a83b3b26aeb96095a633417b03fe2b0370bf3f05c1aac4d9b0e23f2eb53ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394439, "uuid": "5395a919-5e41-46ea-bfe7-fe24306f819f", "comment": "Malware payload (Mirai)", "value": "77ec055c1c65e5ae02e27e0e64a7fe708bae42a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394439, "uuid": "cc433528-50c8-48eb-8d2d-04e56f6b4bab", "comment": "Malware payload (Mirai)", "value": "54264591b56f847af3efe475dd25e5330dae32ef0a5028099621712255915be8b1ee396a5ed07545776721f53eef62b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394439, "uuid": "09079af0-05ca-4b58-941f-69fd4ccae7e3", "value": "T1DB640287FB327C0BCB010BF125DB4B9EA97CA69B42CB9091B6C0854F35F61C576A12D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394439, "uuid": "80db6772-f982-4c6f-a7b0-a6a54ab02044", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiot:p3lOYoaja8xzx/0wsxzSiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627394439, "uuid": "85855b10-e044-4a54-a149-0ed0100f5c01", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627394439, "uuid": "33326919-1182-4731-9d89-26f61770f23e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394439, "uuid": "444b49bb-e287-4f10-9113-0f04574eb154", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f74b64-eea6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627368347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368347, "uuid": "8aad01ad-062c-4a64-b854-2ec91bdaf44c", "comment": "Malware payload (RedLineStealer)", "value": "a1a005a4d811a9d28e788f9f259bc779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368347, "uuid": "514c99ce-9a54-4676-a34f-5f3b50479cc8", "comment": "Malware payload (RedLineStealer)", "value": "4cb49a8991c4cb4b86302e68dc84ed87fb8890abb4627f8e8a589d4d4b15412c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368347, "uuid": "e36a850d-de1a-4b60-b28d-e6b9b68f7652", "comment": "Malware payload (RedLineStealer)", "value": "2b3dd21fabda2d3be84bc60e26f53d995514ab0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368347, "uuid": "01c4b47e-7756-42a8-af00-1d4d3698ea3f", "comment": "Malware payload (RedLineStealer)", "value": "382259a83e42144ae1f5ec2b8f85ac53786b81c834f8d7bc73575284633f99f81a6eae6f7f5957b5d0879abe5df6c445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368347, "uuid": "e3dc4252-9d1f-4d4a-9036-61c8471719eb", "value": "T1D3B3D921B3EC5288F2F76E75427445644B773DA98C39D62C0D9994AE0EB3F40CE62B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368347, "uuid": "c3a51ce4-c925-4312-9c45-2f87ee84a84a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368347, "uuid": "647ab1f0-0278-43fe-96a3-c745cb2bb79f", "value": "1536:CwIOiU5aRa6u6etvMxuLabYF8VQzXqzzStminRnQQ/ghUiO:7SIkWJMyabYVqzzStminRnQQ/ghUiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627368347, "uuid": "7dbb07b0-5615-4c1c-b72a-d9825be4a302", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627368347, "uuid": "9a48f4a8-06c6-4789-a794-d1900981e5ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368347, "uuid": "ccf0c8ed-4437-4a85-aedf-d789ccf7cf7f", "value": "a1a005a4d811a9d28e788f9f259bc779.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59f7f4b-ef18-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627417577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417577, "uuid": "72e2fdf6-2278-49ab-a747-46bbca2926ae", "comment": "Malware payload", "value": "8ae76778cf4bd4ea09d7c6fe8e5ceb7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417577, "uuid": "7dc1db3e-e53e-44ca-94da-2bf627f95158", "comment": "Malware payload", "value": "4d50e241422bc31d14cac7c4fafc411b53e165e27e6f70f33ce0c4266b817157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417577, "uuid": "6dbed4ce-9d6f-4337-81b8-0c31bfecf536", "comment": "Malware payload", "value": "c81411a8d7abcd68fcec07a67dd33a520767f8e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417577, "uuid": "5d515f0b-2fad-4df8-941d-7a0c703a2516", "comment": "Malware payload", "value": "45e08c4f7b9454d217bf24c179f7b634e2e7209d8ee665a94f3e660cffdc15ab684c8defbdd777dd91741700d944a3d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417577, "uuid": "25267926-74ad-4f9e-9a31-e840e8b34652", "value": "T176059DB123287F2BF07F433CA032509167F484EBD729CB89FFA740CA6A25F661255656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417577, "uuid": "31b4d7b8-2241-4367-842f-72d67c3843be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417577, "uuid": "ffc6958b-c939-402c-99e3-a660e513a89d", "value": "24576:a2WC1M1COsBgo0q4wMHJ6pOCo5me19lf:1XgDoHMpcWj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627417577, "uuid": "95c2e379-ac0f-4c46-87f8-dac510d60abb", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627417577, "uuid": "0f7f557c-5ac7-403c-a1fb-e6b74f5facfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417577, "uuid": "e29a8f73-0027-41b7-bfa5-b7324101f4e6", "value": "DHL-AW1258901FE2021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2f4554-eebf-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627379017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379017, "uuid": "fa8dfb9f-04d8-4ea9-b300-b0f4992e288f", "comment": "Malware payload (Mirai)", "value": "6cfad763b43c3f9022807d2a14b0963c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379017, "uuid": "670d9646-ac10-426e-b799-f566b4b90947", "comment": "Malware payload (Mirai)", "value": "4de86f5e1ea936eb4f799c0634f659f976563893b8c1c9b9522f44614c86377f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379017, "uuid": "b2815675-d782-4a4e-866f-9077fe579190", "comment": "Malware payload (Mirai)", "value": "783287e26245da14ffee7fd32c7b56c197330931", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379017, "uuid": "88c0068f-716b-4348-abf2-2bc32206fa34", "comment": "Malware payload (Mirai)", "value": "ee1e270bebe6e152faa8efa46cc1ddc5588053dd3faab1d8f50206cd6b1e68fb416d18e633c400ec45b7b7a2e85d85da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379017, "uuid": "dd0ff293-cb12-4cbf-90e9-9110e50a1bac", "value": "T117135CC59D83D8F9EC5405702463EBB29A77E1BB2169EA86CB9CD133EC42641F18738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379017, "uuid": "358ce436-c327-4ab6-9433-13f6bfac4013", "value": "768:uuDT4N7vqEmuRUY0K5NsCyDM82ClDAyFc2HdURhTlkBuf5pqj1yBw:u+T4N7vq1uRUY0Ul82OyRhT+B25U1yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379017, "uuid": "cd3b993e-9914-4511-b978-70e004da7110", "value": 42032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379017, "uuid": "c57e1185-d42b-4ebd-b8f2-452626a054ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379017, "uuid": "30cd0163-b794-40ae-b7a9-8eee2222a57b", "value": "6cfad763b43c3f9022807d2a14b0963c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef242cea-ef1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627420170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420170, "uuid": "a76c02ed-661e-48c2-9f9f-f0e05e056065", "comment": "Malware payload (AgentTesla)", "value": "48af5cf24f8c7fc448ecbfd55d18f426", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420170, "uuid": "301c3818-f543-4f0a-a791-c0470799707d", "comment": "Malware payload (AgentTesla)", "value": "4e9cbaacb1aaed119e375ac6799f97162442f24a14785e2371b44c5e76125abb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420170, "uuid": "fb6ec838-80f6-4ae7-ae0e-a66a3a45ea6d", "comment": "Malware payload (AgentTesla)", "value": "e3cf38df72fda964da45323b60bc9bd88abbee15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420170, "uuid": "5a8252fd-b2b7-4420-9724-90d3e8d88497", "comment": "Malware payload (AgentTesla)", "value": "667f0505f6ad92102e78dff48a2ce1a0bca0cef669357e844c06cb519714eca28f69561f8cbe044eeee5e45ba7b89c7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420170, "uuid": "91ae0002-02cf-49c1-8e5a-f2dd461e1535", "value": "T10C05DF35F227A744DCB8C3FB185891511BBABCE9721AC7285E84F1FCA8736786AD1704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420170, "uuid": "47385bcd-9536-495a-948d-aaaa27943e09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420170, "uuid": "78bc299c-4348-4b6c-b00f-a9a90aff8c32", "value": "12288:7ebTOvT2oI4VjXsRLhxQoj8fSIIKHNUubHv8RCHaq62IwuyaUVKnp:hvSL4ajxQDSII7yHwgW2Iyahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627420170, "uuid": "ec960609-b595-4f4d-ae0e-953d5a241925", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627420170, "uuid": "db47ba51-68e5-4939-aae3-ab3b9e39ce62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420170, "uuid": "330cce5d-bb41-4f27-9dfe-23407df8a54f", "value": "Ord 2354 png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79d6921-eeed-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627399005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399005, "uuid": "f74efd95-c412-42e2-b230-7e5d4411ea53", "comment": "Malware payload (SnakeKeylogger)", "value": "6fc8b05c55483843b5333e0f2ec7c2ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399005, "uuid": "0be75e63-3179-47d5-91a1-360dd01a7d37", "comment": "Malware payload (SnakeKeylogger)", "value": "4ea025e80130ce357432c651f5e577ee7be047b8dd6d369448f53cf8414ce69e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399005, "uuid": "1dbe16f9-6843-4186-8a8d-0075f44740f5", "comment": "Malware payload (SnakeKeylogger)", "value": "1a102a545be73435889342f112ff646818098b8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399005, "uuid": "ab6f064f-b4cb-47ec-aded-9b1246d70912", "comment": "Malware payload (SnakeKeylogger)", "value": "5691af1d229a43c874e6d4c0e353787c539ec4c9c05e9ca0f09f53794ce9fc56d8f546e273a761f7a888cd67f71270ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399005, "uuid": "536f9c29-0325-4906-91a7-40a15fe4c132", "value": "T1FB157BE0AE0BB90CDD3AA375784980FC83EB7C1651CDD3E22AD7F9EA672326415915C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399005, "uuid": "610d4562-cda4-4d38-8f56-9cb62e408834", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399005, "uuid": "70df3689-5200-48b1-ab26-057866506031", "value": "12288:5l2jEf4x8OW28RgEm/84+luFlagN28p2ox+9A++ZOlsyaUVKnps7INeLc:72jRj8R0kzYFlaD8rZyzahpPNeLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399005, "uuid": "1a986193-f3f8-455a-8c6c-7f11f4395d20", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399005, "uuid": "eaf6c9d0-a6e3-466c-8575-a37697b0e2b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399005, "uuid": "fb82506b-a0cf-4d17-b7b6-8d99f96c2982", "value": "Order Drawing and Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d5c697-eed5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627388556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627388556, "uuid": "62122293-dcf8-410a-bd88-ced0db932de5", "comment": "Malware payload", "value": "e49af676fcf6b37a1c20fbb051def0f7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627388556, "uuid": "fc9ac5fb-f0b8-4bb2-9ca3-5ddaa92f74bb", "comment": "Malware payload", "value": "4f4a32bccca7f6b80351aabef3fa91468de8b26beef29683319dd9e14743156c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627388556, "uuid": "f4c0f6d4-e7f8-4941-9c68-1e8863964f94", "comment": "Malware payload", "value": "6a60672e8527335d6c76d00df298c98d22aa6bea", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627388556, "uuid": "c5d3c4b7-16d5-43fe-b3f3-4aee7da6492f", "comment": "Malware payload", "value": "972c7b4deabfcf18429c0d0c72415280603fe5644ee63372923ee071afd9f6a406ccc92250e1217167a434b77e07d055", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627388556, "uuid": "2af3f883-0b97-4c3b-8283-75e58d626583", "value": "T162D5AE2239C6C532E97E41306929DB7A16FD7EE00B7184EB63D87A2E1E705C14632F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627388556, "uuid": "5aa415d1-9a09-4f02-9ca3-f5226e2c09b9", "value": "49152:pIA5oTjQgDA4NL1kYBxZVhtQliQggstwBjKBR1lZZz9xnvjkLYtRNgiBYFGJszr9:V4NLeYHYrBjKjvXBQi7rGHa72G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627388556, "uuid": "ece4b08d-d7a3-47b7-8d67-94dd71c5adad", "value": 2859520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627388556, "uuid": "3b06b2ea-7f4e-4317-8093-44f4d793bb60", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627388556, "uuid": "ed85e6f5-a02b-409b-ad57-f88c33356bd6", "value": "NEGATIVAC_96612.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70528896-ef2d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627426400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426400, "uuid": "64113049-917d-4bcf-878e-aa2f900117ee", "comment": "Malware payload", "value": "ca9ce774706c2f1708af10d3da19be03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426400, "uuid": "a541eb49-4c04-4adf-9cee-0f1c8b7e73b1", "comment": "Malware payload", "value": "4f4b3dded538765e48f27d8bf0ef605572313a3f95f71f642daa53402abd8776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426400, "uuid": "ae6ab4cc-f636-484e-965b-c13ccc90deac", "comment": "Malware payload", "value": "059fc99b8d6ff50f997d7acb1a0ccf55cc776605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426400, "uuid": "4d7f0b0a-96af-47e0-9111-63a13d0164ef", "comment": "Malware payload", "value": "855a46e7d03fb9801243e88402588fe211bb7ae6cb606a1279f85c6fc4c443f2fc315f967234c5c9209102f9b04fefca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426400, "uuid": "482ee428-c26a-48ed-892d-6509d38790c2", "value": "T1B2D4AE95269037DFCB0D0DB244E1AEA56F349E796901F2771C8534FF193ABB88B0B14A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426400, "uuid": "2e1aaf45-9050-4df9-92e2-85cc6ab18b70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426400, "uuid": "efbbb93b-cfea-4b32-a484-0d20b90606f9", "value": "12288:DeMOEti1x8SlqOs9XU09GD4jPFAxfdd+12aXVnt:DGEtoll7uGDuwdUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627426400, "uuid": "510bbf9c-7d3e-4354-b14d-69a5d46d4dd5", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627426400, "uuid": "b9aa4c93-01f9-4154-a525-7cfcfb394690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426400, "uuid": "b293f0e5-54c8-417f-8203-428ab5f0d837", "value": "EFINAL REVISED_INVOICE AND PACKING LIST FOR SHIPMENT Email no. M1053 dd. June 26, 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d870b1b7-eea0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627366015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366015, "uuid": "767a3146-8437-41b7-a094-cfc64964e34f", "comment": "Malware payload (AgentTesla)", "value": "15e2bf94719a98435c1c99326541b5f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366015, "uuid": "a47e9928-2ec7-4aea-9373-625acf855cae", "comment": "Malware payload (AgentTesla)", "value": "500c7992cee573057608d6cdb64958b16c4d6a8605be652dde71b579db731419", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366015, "uuid": "5bc70929-b710-4e20-adf5-2adb03c1567d", "comment": "Malware payload (AgentTesla)", "value": "29d9b053727792ce4ffb1602319b8dec811b921a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366015, "uuid": "aefcd4b1-b8a9-4b17-b43e-91f67fbfcd9a", "comment": "Malware payload (AgentTesla)", "value": "21c38f19029de1c27ec40823cab13387aad27ebf40eeba1281464e17159e0b5d5ec947e300cbe335296dc41e6bbee6d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366015, "uuid": "706db7fb-4b5a-4c26-926c-2b0fbb21e7f6", "value": "T182E4ADF83139775FF49384BE64B01CA6695020FACA2EC752F72341ABEF1D49B9940693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366015, "uuid": "66fd3150-3524-4712-ac56-49ae7ab96278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366015, "uuid": "ea1ab3ea-cc08-450e-b06e-e906181f02b5", "value": "12288:xzBYS1PmllF1tI1Yr3d9WGLNNHS2+LHoR7mo5oFCEkv:DYm+DeYbyGzym7mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366015, "uuid": "afe13edf-80ba-496b-9cdb-a90f64b678c4", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366015, "uuid": "c677c012-1e12-4dd1-b0f2-0c13f85de971", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366015, "uuid": "de813ac6-0df3-459e-8809-3a711d5aeaf5", "value": "544425P.oINVO.pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf5d853-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372249, "uuid": "bc70fd28-0f88-4e55-b3b3-e63f7162a5e4", "comment": "Malware payload", "value": "eb23498b68915565574c5842c278ef68", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372249, "uuid": "ccf2f690-a637-4b33-9734-493d78a01391", "comment": "Malware payload", "value": "50271b0ebb8146359d0ee758917d0dace17831665c3991c640f4dadc1110d7f3", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372249, "uuid": "e26f4b38-a9e4-441b-85cb-d718fb37a130", "comment": "Malware payload", "value": "2b1bbbaec1341150186d59aaafc05e4a2b3bb149", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372249, "uuid": "10f17e24-971b-43da-945e-342ce446b3fa", "comment": "Malware payload", "value": "154c113cc9004fe150e2df4d1fc22fbf8f8f181002b507d19cb0e5c81f299f0b3898406111990451c933f2b63bb90c58", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372249, "uuid": "8fd3167e-808f-4e76-b0bc-80d25372063b", "value": "T1CE4512D0F77A87A5C61BA0B4AE36E52649BCDD055718D00F3B8B3B0075F8B64F9A3816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372249, "uuid": "7ab7df74-8c79-48a2-bc05-8ed98cc60220", "value": "24576:61EHBajjj8wTfksY4nrVf8EI/bKQ+xKaiSDaY8O6bn:AEHBajjjhTfjJfI/mQ+xTXDask", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372249, "uuid": "9fa0b380-01c0-4a6f-b87c-f16981badfd1", "value": 1212928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372249, "uuid": "b86fde85-057b-48f2-b437-0f2591881b44", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372249, "uuid": "f2fc316c-710b-4fa5-95bc-89c614b139b9", "value": "Agency Appointment-Posh Dauntless.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b1b83e-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1627400181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400181, "uuid": "d5af259e-caaa-468e-9eea-1a997e8286ab", "comment": "Malware payload (CryptBot)", "value": "737d02c261755ff5c920fa52d4f03fce", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400181, "uuid": "c94b4681-787a-4fb9-87ca-0da7a076e0f3", "comment": "Malware payload (CryptBot)", "value": "50f41c07db1d0d625cd0746a78dc15a1193f4fd0f80e6a4df40315f24efe2110", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400181, "uuid": "830ca28b-6980-4ee4-81d5-e7b708bd0bb2", "comment": "Malware payload (CryptBot)", "value": "bf966e82d41c1fe537763339fa779e3ba9236331", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400181, "uuid": "02721463-aa99-47ed-80aa-f656b6c4aba7", "comment": "Malware payload (CryptBot)", "value": "e47fbdee8938e64b7d6988fd6b26f67ea8dce72e1a309ad1e8a4e3cfb21871dfd0e1ba715ebaf68deba2a44bea3d9bf7", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400181, "uuid": "cca02a9d-e8b3-407b-8693-d56a816411c8", "value": "T141F4F130BA91C834F5F222F8497A8379A53D7EB0573452CBA2E52BEE46345E5AC31743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400181, "uuid": "6eee5af9-e6c3-4ff9-8d47-9b0c497879d6", "value": "cd8b6907b5cf87baf066346ab3baafdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400181, "uuid": "7856e204-cd83-4a47-9fe6-843b91a180e0", "value": "12288:LfzsUnViD0DUj9rIS7M1NAFZaquBKFrj+59APMQme+alY7WSmdAon:LYUED0YjdIALar0OADR+afSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400181, "uuid": "bf302474-d98e-4f2e-8d4b-319bc1d5264e", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400181, "uuid": "d09a9c80-6a06-4959-b245-02a8c55ca3ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400181, "uuid": "2a4d3902-b91e-43b2-b456-aa7fa8a60f77", "value": "737d02c261755ff5c920fa52d4f03fce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac51c49-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627399869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399869, "uuid": "61cf8a1b-f305-4d25-8dfc-3798c5c51789", "comment": "Malware payload", "value": "ef4c89cdf0592492e3ec2ac4003ce3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399869, "uuid": "0117ad1d-2cdb-415c-9cda-75718e86ecf7", "comment": "Malware payload", "value": "516099b8e692f4d93c99710fa926611c952036c9b13cd46e9413c2398b7659cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399869, "uuid": "a852da92-d789-476d-a7fe-7ce71045b548", "comment": "Malware payload", "value": "6709e405f56fc846ae14302ea04a8f89b052a2b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399869, "uuid": "21b74530-e059-48ec-8c5e-2187dd14fc2f", "comment": "Malware payload", "value": "a3a17c8ad78dd74c9a55f7279c5791963c1f216c15686d900b31eed6b02d84091d6502408794d328fc95d9e2cf179558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399869, "uuid": "f7808be5-3cdd-4638-8099-504b6abc3e07", "value": "T14075010B9AEF117BFC552B71D02548B310FBF9F60E4A4722F6E1E60D2A70FA155384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399869, "uuid": "55a3ac66-6325-4a8a-9c10-e75c593f3427", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399869, "uuid": "8eae3e75-1867-4d37-8d39-dd6b3d152981", "value": "24576:xcCT67wHqWis4l+j2ACFr5hqjiLDpSJDN93pqb6W8cU4gLQ+A:aCpn8H74iA3qb6W8cU4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399869, "uuid": "e0bcbb62-d929-4dc4-9a88-0e4622a12ec0", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399869, "uuid": "5fa59652-78de-46c0-a8cb-e7d50df78aa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399869, "uuid": "3da22063-03bc-4548-ac60-fdc7843dad4f", "value": "KEUDdkSPh6K1fOb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d41d3bf-ef0b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627411684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411684, "uuid": "0aefb6f5-1f23-4f74-806b-a8dcbd25b444", "comment": "Malware payload", "value": "10c55ac6b300e7e64a787ecd1ee95de5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411684, "uuid": "5470ae4d-ea2f-4c40-9fd1-e51eada41e64", "comment": "Malware payload", "value": "517eb00d2c56a5f1f083dcf451664a95cd3732ba4335792dddacb0ed12111613", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411684, "uuid": "1a61608d-693c-4f70-9de0-70f2db7684cd", "comment": "Malware payload", "value": "d958db330fc03846193371c52ec959ef3f310705", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411684, "uuid": "f7443e4f-12f9-4952-8839-f64a71da3d38", "comment": "Malware payload", "value": "3220a1d0a9418af3c1f5ac81062b5d61a76d76f1e0a4f15083f79bbca8d7bd3f8b1ecd4ed7487cfad68392e83520a2cf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411684, "uuid": "c7a6dac3-cf36-4536-8d88-5ed9cfb2c74c", "value": "T10D93927CD1570598CF83A7B86B1B5F45148C762EF389A1327A789B382BD2C7A4122D7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411684, "uuid": "81a42d70-2cb5-4021-a998-591b17f8d774", "value": "384:0cE0FwdvdLE4yvACr+yCyeuM9tx1RSv10x9vx:i0cvdLE4y4uVHu7m149vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411684, "uuid": "6d868c5b-16ce-48c5-8bc8-6059dc45abda", "value": 89291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411684, "uuid": "64bb5db4-dd96-46d5-9459-613df202fe52", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411684, "uuid": "9875e320-d21f-470b-89d2-a139f5594acd", "value": "Payment advice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf08201-eeb4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627374425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374425, "uuid": "d0870ed6-9df0-41e3-a825-57d3c8cf5eca", "comment": "Malware payload (Formbook)", "value": "7390d6d45152e7410b00e7016c176e88", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374425, "uuid": "34853dd6-a9ca-4fb6-a7b3-3279f095fa30", "comment": "Malware payload (Formbook)", "value": "52ba394876871545b58db9c8a0303fc3bfbb353cc4de1abdd1d2d51122b16fe9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374425, "uuid": "6d396d3c-f12c-4085-b854-885cc0d93753", "comment": "Malware payload (Formbook)", "value": "60aa33cf23d58b88d5489761c90ef641a88ef7f8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374425, "uuid": "b035f651-7680-4a11-bb15-424d909da98a", "comment": "Malware payload (Formbook)", "value": "3fc32d100988e49adc7c413186f26f923d4074d7a86df1863328677362f7bb217790d8ef5eaaca758f3aae6939cb6edb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374425, "uuid": "110956de-3d84-4502-9ed7-27f8e4c08ecf", "value": "T1EAA42337CBB918BDDAA45373E0A51135787B7231BD22BDFD8244D92BA2613B0EF1A150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374425, "uuid": "869f4449-01b1-4443-b784-04a22f16e800", "value": "6144:1X+dqCsjBuAPjqi5kD5pe+ckghqlVEClIzEQ7TQcAdq1wYzBLpL3/jWk2D1hRvWJ:0uLq8kDC+cxwljQwaXzB9L/b2LvoEdRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627374425, "uuid": "1f8e2ea3-9424-4aaf-8b46-aa196a997a87", "value": 473958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627374425, "uuid": "9d3bde00-a6f4-412e-b835-975fb35618d8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374425, "uuid": "74ea87a9-38a1-4b81-b997-d280248e320a", "value": "Inv_7623980.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde42c47-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627400814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400814, "uuid": "4a9f52d5-0f24-47ab-ab99-6cada0bbc6f0", "comment": "Malware payload (Formbook)", "value": "346c1f083ba87535c999f17587d0d8b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400814, "uuid": "ffbb7f3e-57d7-4677-a0e9-e130a18422b1", "comment": "Malware payload (Formbook)", "value": "537a1b1e9a633875a74664967b2e62803f01b619fb26df9b4762b6795ee1b0ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400814, "uuid": "f087459f-20dd-4295-b34b-953fff70acd0", "comment": "Malware payload (Formbook)", "value": "82a6caee2df88f4944f0f144e70f8d70675ec45e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400814, "uuid": "f9fdde29-21eb-4b7a-9aff-c389183f03ee", "comment": "Malware payload (Formbook)", "value": "760cd206a4e9a780677288fdfc92b9b5329abecd33bbb9157dc39c9e6ae01776b998311244e3e0c51e82e7eb1784ab58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400814, "uuid": "776eae62-42e9-4459-9ac8-5927e44bb76a", "value": "T16E44022283DEDF70E4B201B5827D51321A7B37771B2F9ADF9B80602539215C1D939B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400814, "uuid": "30796f50-381b-49a5-96af-10543dc6ced8", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400814, "uuid": "21c446fc-5233-4a9b-8d46-5cdc27e5c01c", "value": "6144:sd53TvpHeIl0m7YIK9fdiqEOfdaEujuUNrYnKX2xB3ijwOlSMJIZ+:sd53TvpHeIl0mkIE15yNrYnKXwpShJI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400814, "uuid": "f8fcc3ad-0f47-4a6f-b1e4-6e97a4378ced", "value": 258467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400814, "uuid": "ecadffbb-2c5b-47f4-a28c-89e58fe3cbc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400814, "uuid": "6762ecb5-f44c-4e1a-a632-24cc5ce511a0", "value": "346c1f083ba87535c999f17587d0d8b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6caa8e-eeac-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627370988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627370988, "uuid": "98175ccc-df7e-437d-9ef8-85d8ff682ebc", "comment": "Malware payload (Dridex)", "value": "f83db854151b10b3d0401b956fc3e22e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627370988, "uuid": "be0a39f8-1f90-4403-ae85-2c32939c9e86", "comment": "Malware payload (Dridex)", "value": "540ffe6a7836cf941f49b5b9110ad53943c7abd552f3273cdfd9fed7c938085c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627370988, "uuid": "5d6638cc-3342-483c-a76e-44d600181806", "comment": "Malware payload (Dridex)", "value": "f5eacc7cd2eaf52541be5ce49b898e3414c36f1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627370988, "uuid": "520621a3-1919-4967-9b81-610411570448", "comment": "Malware payload (Dridex)", "value": "fd68af5646966f9c90225d18584fb0d7a9cdc2701a5a391c4738106e88cf6bbe3e5679b4613d280bbdbf07a0d7c59179", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627370988, "uuid": "467bce3e-3dbe-44da-a37e-c66635ebc906", "value": "T11A93E09ADEF25599C3F014FB121113920EFB9AF12DBAB063708722DF59485474AAF36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627370988, "uuid": "9db4f2e0-7daf-4b8f-8810-90ff45ddafae", "value": "1536:/q2wNDnFJseDi4FfDrmUYqk7XmUqQI5hkEca+7UUfYTQjWhKwX5EeEdECGF:/q2wtFZ1fPm1PiUqQIkEcEWmIWhreJC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627370988, "uuid": "35487c86-6e08-4f28-9d9a-d972c56587ba", "value": 92006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627370988, "uuid": "7a538e6f-00f7-4126-8a68-dcf795adf9b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627370988, "uuid": "78fda807-8e6b-4abf-a54d-c6c79240e433", "value": "Invoice_57212995.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ddd81a-ee83-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627353393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627353393, "uuid": "fd78b64c-28be-4f02-8489-3bb514cddc4d", "comment": "Malware payload (Mirai)", "value": "f13e2241b748cb72970d5198a3a5cfeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627353393, "uuid": "31b178fa-8561-4f2e-8ea8-9501e594fe36", "comment": "Malware payload (Mirai)", "value": "548ce35084f9bbe535e6aa143bc31d44dfea9f34e1ff479a83a10a0befa0a004", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627353393, "uuid": "0206706b-c1a8-4990-8267-5e366f1b7dd4", "comment": "Malware payload (Mirai)", "value": "e8d970b6797665742c5f30819a7d02f30cfecc60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627353393, "uuid": "f2c75e22-da50-4333-b8fc-c90583829341", "comment": "Malware payload (Mirai)", "value": "e39cb7bc5a2437e0cdad1ad83ee18b2cf007db4fa6c517b4343dad37bab27af99d2619446d4d600607559accd88b5188", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627353393, "uuid": "8e8b3352-b0f5-45c8-a89f-58fe12b3f6fe", "value": "T14F738D31AD7A2A67C2D0A03B42F74775B1F2078E29A88B1E7D710D4DFF24A60652717B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627353393, "uuid": "db3b93bc-073a-42b8-b814-9a4f274c4858", "value": "768:X73NUXyo5mJjXxoy9z0PITL9+NWoijNO/cgDxB8Iien69J4SG9O+PVmbNTSq:rdUXyqmJjXxoyuwNxU/3xUe69QdmbNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627353393, "uuid": "8c0a560f-f900-4c2a-a54c-65e654cf77fc", "value": 74800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627353393, "uuid": "bf955700-e168-466a-ae7d-c4d2d941d293", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627353393, "uuid": "ce8bf19a-00f9-4807-b16b-123e60447e5d", "value": "f13e2241b748cb72970d5198a3a5cfeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ae6ccb-ef2a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627425327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425327, "uuid": "f5cde8ff-3778-46ed-b7be-71cf5a46167b", "comment": "Malware payload (AgentTesla)", "value": "6fa33275b4f3de73faabdd5dc084f0c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425327, "uuid": "0b35fc90-113d-4a12-ae54-a0d6167e1e3c", "comment": "Malware payload (AgentTesla)", "value": "54997c9767d784fc3d566238940f84541c4b614ec794aceeb84d2bb8a4104bf5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425327, "uuid": "0ff7a504-be5f-41c3-bf0d-c9383d578003", "comment": "Malware payload (AgentTesla)", "value": "8b624a452820e2949eec05c2e16c6cb0cd685c12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425327, "uuid": "4720fe1c-3cea-44f9-a1db-e9a15a6838b8", "comment": "Malware payload (AgentTesla)", "value": "365ae11fcf61dc45e9562b32e47ba8438f1abd9d81255467b76a970a812daa97305cf1fe1362de344c9aea27ece4a6cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425327, "uuid": "5dd44591-39eb-4974-9056-b558408e528b", "value": "T17D45D0B555904A53D27AA773C1B1AB00EFF46962B281DE0E16C3F1D31E62712998FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425327, "uuid": "e285b64d-f3cc-4394-b546-3503cefa30cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425327, "uuid": "c485b204-68fa-4251-97e9-e5ba04d9ad78", "value": "12288:rKEvPYypPP2JNU20O6iJ+K8/8qkiFhG7SYLRWhwB3H3I/swqHpB9hDsC07tHNHVl:eU2GisKophkbLR5B33VLHDfDJIx+ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627425327, "uuid": "c5bba8cb-fb38-4b15-be30-51a2c5713228", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627425327, "uuid": "6761ba3f-9962-4899-b171-ea67f2ea42fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425327, "uuid": "fd570368-6d38-47ef-a741-d06192a82664", "value": "bank account details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d10669-eec0-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1627379748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379748, "uuid": "09bb0122-0028-42d2-ad9a-7263253faeb5", "comment": "Malware payload (Gozi)", "value": "9cd7df223162e4e246bf212bac6c19f6", "object_relation": "md5", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379748, "uuid": "adbbbd93-a482-4e7b-a717-8133c6839ed7", "comment": "Malware payload (Gozi)", "value": "55449836b446ba52fb72c9a706ea2809509f0358bbbe80534b3e2b031a992634", "object_relation": "sha256", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379748, "uuid": "8000a09c-d5a6-4f5d-9b7a-ccfb3c050b68", "comment": "Malware payload (Gozi)", "value": "badf7723afcbc4f319e768ef380b8dd06bd23764", "object_relation": "sha1", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379748, "uuid": "27218b5b-64c6-4bd0-b3bd-3b3415a27995", "comment": "Malware payload (Gozi)", "value": "571e365be814cddeef8ee68708d061eee5edd245b44bb6f326e30889aa6ee988300bae1d41c09f047820e3e1588cf490", "object_relation": "sha3-384", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379748, "uuid": "4825683b-8470-40da-8e95-3533affff602", "value": "T1D442C05EDF4368BB477F02FD88B85B3D26AA3E04518596B41413216AC2BBCB0D7D0E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379748, "uuid": "f0fb459e-6833-4b7e-a35b-d18a4678fee9", "value": "192:DzH3pAeW5J91itjWnTGb6gz6er82teh5LguJUB5QOu73kfHdhcnI+/ivf6up8P6U:/p+H0jAi6P5LguJUB5S73k/dhcnI+/Um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379748, "uuid": "dac03f15-8c53-45c2-b088-9bbbefac393f", "value": 12114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379748, "uuid": "97d8a828-988d-4317-80cc-7c5c6d067b32", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379748, "uuid": "cecbf059-d2b4-406c-a1fe-d00631dd8757", "value": "form.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f5315d-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627396611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396611, "uuid": "61646316-f3e5-4b2b-b851-f13b084bfc23", "comment": "Malware payload (Formbook)", "value": "0c0b60565c79f37d0e1d15b3b2013fc4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396611, "uuid": "f7140c96-38f4-448a-802f-f8bdc098941c", "comment": "Malware payload (Formbook)", "value": "555467cb88d23529540d6d644cbd1862cf04a728d783b0f908457c073d5d5316", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396611, "uuid": "db41fac3-45d9-441a-8e6a-b81319999410", "comment": "Malware payload (Formbook)", "value": "efcb55212302d0711069bdca97897b45f739358a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396611, "uuid": "64daf9f1-542c-4c96-9901-289300ea8c58", "comment": "Malware payload (Formbook)", "value": "419b662c6493fa5cfe231b4511d6580f0c2780f3479498e5a3aa2fc9b56f2a8f849da0a9447be703144aa70bc8e478ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396611, "uuid": "ea68404e-1a5d-4729-9aeb-b3759e7ea108", "value": "T1689567F0AD01D4C1F57A5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396611, "uuid": "87673b4c-5c83-4b8e-af39-2a3108a96816", "value": "12288:A4yZR/uuychjuivKVxAXnG+sFIZD6ZBlhqpuxEOj2NMS5Wsw6Z8hn0vKjIqOW:/yPqvHAXnG+sFIZMjhgkE6eyn0vKjIXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396611, "uuid": "ca819bc0-aa9e-4241-adb2-d92393dc0ef3", "value": 2013130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396611, "uuid": "d9ebd76e-5191-40eb-97ff-9f13f063dc45", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396611, "uuid": "b5ddfcc4-58a2-4d44-b9a9-b90bf1ddfb69", "value": "ORDER -ASLF1SR00116-PDF.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a94a1a-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1627396829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396829, "uuid": "12b66bc4-7a18-4db6-9d2f-dea624b49721", "comment": "Malware payload (GuLoader)", "value": "35d7090f97fb9d73cc026c87b6f233e6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396829, "uuid": "194ca612-40c5-4a74-9318-6f78e0fa9ebc", "comment": "Malware payload (GuLoader)", "value": "56839f1221dffba3e134d4a0d4fcced6ed37304af230e721576f0635152668a4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396829, "uuid": "360886a0-d41c-4ad9-842c-0d266d506e04", "comment": "Malware payload (GuLoader)", "value": "b2e18c7411a925f72559b1cb1c1d8f6686ca59c6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396829, "uuid": "b9bb2151-9255-47fa-8a0c-40780ec6549c", "comment": "Malware payload (GuLoader)", "value": "3f4468773739365626aa0018d64646e559280ce8c6d717971196687e708f3cbaaeb94707e6e8b173c27ec1ec9d344351", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396829, "uuid": "f6914cca-06c1-4645-8930-d1b2a76e8065", "value": "T1FF451294D7F8AB76EF0F10B11646939521E44E410708824FD3DA76BCA1FE2A4B59BCF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396829, "uuid": "fc7cb92e-7f73-47cf-b60e-3a2bd4cb3d73", "value": "24576:t+pfpukO8aDZo6Q0biQ+V6lAfP/R1JWUY/Y3CLK+KnOr+AOMh8xGoRSXCoU921zl:t+pJlaO22Q+V66/NdSLK+Kna+AOFGoR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396829, "uuid": "7865bc46-a2e9-4c6c-8b59-5e9bc601b478", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396829, "uuid": "2166e424-2c5b-4909-9aa2-36766a233e57", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396829, "uuid": "e9a6278b-b1f4-482b-826f-671d295a7d68", "value": "Invoice & BL copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd98f2d-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401834, "uuid": "9fb045e1-5760-4e1d-a4f9-081c03f11fe5", "comment": "Malware payload", "value": "560748a34effbbf951daf3b8ca24289f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401834, "uuid": "ae2b552e-52ac-411a-bb5c-211839b103a1", "comment": "Malware payload", "value": "56d24e5d0336a8aefcaab14ba38932966d7f69c46ea874ab8d7565ea6de94a7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401834, "uuid": "0c4e6f07-6a9e-40fe-acaf-6dbb0a174aaf", "comment": "Malware payload", "value": "806be19d38b6260b2fc574a990bf146485e44ab9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401834, "uuid": "c38a8a8d-8f4a-453c-bc41-8c0cc1721e76", "comment": "Malware payload", "value": "39021faf2d4472fe2eb8fe0da47654cc6711cb1fac52bd0b5e858e30720ce2504c52e6ca8ca0e795ece941e90d5a8d54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401834, "uuid": "de89a3d6-b0d9-43c5-90d5-9bf3bb1c6e23", "value": "T107E4BEF83539375FF493847E64B41CA2696020FAC92EC792F73341AAEF1D497A940693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401834, "uuid": "3bf595b9-25fc-46aa-9e9a-c808fd62a488", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401834, "uuid": "aa502797-c41f-4933-a2d9-853ef0c29bf9", "value": "12288:2bhQLHvSw0OKr3Xvn/orRT0p0mXvYjFytnYT6jAK4MfgNPFk7I7mo5oFCEkv:20PR0O4nvn/8RIzXvYswT7mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401834, "uuid": "0ab5113d-7e8f-4d82-9008-4c4ccd30311d", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401834, "uuid": "ea0501d6-a6dd-4cf4-a74a-24c68544060f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401834, "uuid": "85f8eed9-93b2-464d-8d78-535a97d83859", "value": "560748a34effbbf951daf3b8ca24289f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160f57eb-eef2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627400908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400908, "uuid": "75878f53-b072-4b28-a513-01f5dc34f609", "comment": "Malware payload (Formbook)", "value": "b60fb0b3174ffd6ccf46d23e5dd4f291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400908, "uuid": "d9ae8278-0dff-4337-8e74-6d50fcd2415c", "comment": "Malware payload (Formbook)", "value": "56d324b70dec3c259864216d918929470e10dc5582ae70f238aaad4887358d7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400908, "uuid": "10105dac-e8b6-4700-bb6f-59246b11cc86", "comment": "Malware payload (Formbook)", "value": "fedb0bc2f7e46d58061b8742b5d5ad61b525ab4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400908, "uuid": "5be3b54c-d47f-4e9a-a2f4-1b7d233928fa", "comment": "Malware payload (Formbook)", "value": "d04521488f03c0d29a9f50ff1af276d7a85ef9334fc95cc95f67d7d3b73278535fb9a6ebbc05d5ef59020e1d8097b951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400908, "uuid": "c03ac3d9-e801-4ae1-9b16-b0a1084773ae", "value": "T12675090C6DDEB26BF65B11BC356C10D85066FC19C708ADB7AE0ABBF67062E95503B087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400908, "uuid": "a205cf1f-0801-45d4-a183-50d06954a440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400908, "uuid": "293e0544-e3a0-4128-959f-ffaf5e223d4d", "value": "24576:+zaGW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hu2:MWiec/Pv8cvAAnnNQuiNB/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400908, "uuid": "1176970e-5811-4904-a1da-20233ffdd2cb", "value": 1652224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400908, "uuid": "630a08ca-a84e-4185-8869-d89e6e32dae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400908, "uuid": "8127eb1f-6065-4a06-9ed8-8acf72102ee4", "value": "b60fb0b3174ffd6ccf46d23e5dd4f291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae057a52-eeee-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1627399445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399445, "uuid": "d40e43bf-20af-4cca-aea7-6b0dbe852796", "comment": "Malware payload (STRRAT)", "value": "d375b26e07150dc37dae2ce7d22a586b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399445, "uuid": "0002ffe7-dac4-47de-9b70-836805b90713", "comment": "Malware payload (STRRAT)", "value": "56f0a10c33da16a1d597d2772bca21ae3e39cc179cf31eef3fa623480580bb61", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399445, "uuid": "771b85cd-188d-4f33-baf9-1b95e536ae79", "comment": "Malware payload (STRRAT)", "value": "8d4ec9d1b48c5cd2ffaeae674c8e93b489a5c171", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399445, "uuid": "196c23b7-f36a-4d21-ad8a-dec5431014f4", "comment": "Malware payload (STRRAT)", "value": "0cb3d4fa787917266496b5bb0b810f508a5bbf8a4bd33c297ab3b221a56285cf9cf6239600db5e3a071bfaf4f8f04c27", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399445, "uuid": "496a7e89-5fd0-4a4c-95f7-e3e66d3d599b", "value": "T14BA3CE6F3ECAC1B5D00B883154519133AA1E2599F845E02F26FD91C61D78DCE2BA6ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399445, "uuid": "8349ac69-424f-4b74-acd7-62261e286688", "value": "1536:cjSW+gbZj1hXLp8tmGiwvzk//zNpPShwbRWNcRcqrdHc4CSshc/6yN6:cjSW+QZjHX6tgGadAqp8nSsnyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399445, "uuid": "e3dca02f-0476-44dc-adb0-27ec4c2c27ee", "value": 104551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399445, "uuid": "a02e1ec1-3cca-4adf-b353-a84e4beab16e", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399445, "uuid": "3fb3eb45-f419-44f5-937f-091e66b52b60", "value": "000122223.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66e56f4-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372079, "uuid": "2e8b568e-251f-457a-a08a-952d77762787", "comment": "Malware payload", "value": "fec5264e6e4e5aa8d46e4f12ddd91b42", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372079, "uuid": "ea4cde59-4126-4ec6-becd-2933f133af0d", "comment": "Malware payload", "value": "56f8d8a26b6064726c8bd673573dfd0a9344b642de59f6e65eb3748c08d32312", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372079, "uuid": "d695e1d9-86ec-47f2-b196-bde036bfaf7c", "comment": "Malware payload", "value": "59c9e51cb848d150f68eddfbe1c4f8126a813075", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372079, "uuid": "139a5920-bdd3-47e4-9655-172119cc02cd", "comment": "Malware payload", "value": "6f9a8d5841465b4c0511edb2839b0c6ef5157cb241d82b99655f541c1ed3c306d0b3542b7eb0e8e27cd293218eda9c52", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372079, "uuid": "f776ce34-89b3-4ab2-8f0a-f639c41d25e5", "value": "T145049FF0674498D2EB9F9B97A1597D9C1325F07BADCA218C014AFBF52A733418A0DCC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372079, "uuid": "6b1e8a50-571c-4df1-8120-189dd744235d", "value": "1536:nlcQij0Tx01dZCz7ROGolfQ1aMt5nYTmdY6NZUF9Sw5HRaTx995iVZBSgP+ZdI++:o+KwvZxoPDNE/eqanTzHEdY34QpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372079, "uuid": "ea20416e-1ff1-44d7-9fb7-bc732b633c1a", "value": 176068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372079, "uuid": "e5ea0fed-7268-4814-bda1-4338625ff069", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372079, "uuid": "ccbf78d3-2a5d-466c-90ee-9569b16900ac", "value": "76584535536-26072021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4926b8-ef09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627411178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411178, "uuid": "494fcdb1-85a9-47b2-b526-c87054048c20", "comment": "Malware payload", "value": "6afe8e2d34a9d246a441fd8ec98790f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411178, "uuid": "48696030-fb19-42d1-913d-2daedcb22a93", "comment": "Malware payload", "value": "5706673bd610b28324bf042be367bba2f04d5b6f1efe310a51d018295f317249", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411178, "uuid": "ea740c19-e478-4047-9958-06bf14e2a27d", "comment": "Malware payload", "value": "f2b892e94a9b82ced759ac9b17a16cc575cbaae6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411178, "uuid": "0439a350-4ca2-4e79-8e4d-d134c119c428", "comment": "Malware payload", "value": "a514ffa5c73d163a4213f26ab593ebe96e5eea8a281ab771cca5a683d8a00731c8278710f99553ea02ff89fec1fa49da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411178, "uuid": "f6e31f0e-ec80-4580-bb1a-58b50fc5d537", "value": "T13103E168D1D65AC9CDCDDC3DB08E83626DCCC182396F1388736E9C85A69510FE69D8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411178, "uuid": "4329a9ba-2f3a-4e1c-af04-9c794acaccfb", "value": "768:jCTCqdab2OtrMyJseg87M9hdy5Ip5EOYrpWRy:+ab2KoOlg8mAKdYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411178, "uuid": "a5acacb0-8eb2-47b1-8ef0-85857ba5dd52", "value": 39164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411178, "uuid": "58f1183a-308a-42c0-9a10-1698e4d6f1d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411178, "uuid": "e2ba8504-7fe8-4fa5-bcfe-56182c67bc99", "value": "6afe8e2d34a9d246a441fd8ec98790f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc1a2cc-eedd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627392062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392062, "uuid": "b99f4182-92b4-487e-a57a-ad2aa8bc386c", "comment": "Malware payload (RedLineStealer)", "value": "ad54fbfa5cd265112f67ea1b4d2e95a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392062, "uuid": "ae4466d6-412a-4be7-89c0-be0dcbd74bd6", "comment": "Malware payload (RedLineStealer)", "value": "57430cbbfebdef7c54698b00102dbd2098aef53ba4bd5fa43660c2e306f53482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392062, "uuid": "c77721eb-f07d-4b76-89f2-4832e26e8a5a", "comment": "Malware payload (RedLineStealer)", "value": "b92e996cffa1ad3b6e6a0c439f1bf21c72ccce51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392062, "uuid": "f98015fc-2120-43dc-a874-405564617ca1", "comment": "Malware payload (RedLineStealer)", "value": "9b80dcb5b54d9481e979095bcad5ff876b8bfdff82c8a993e65641dff8fcb2726c26b0b9e84e0f5f7a80a0cc7250ca9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392062, "uuid": "0e1607bd-fd94-4fa1-9e3b-903c6e510e13", "value": "T1E2F4E4A4625A4953F12281B7F012EBB0EEF43E122601CD1659D6FF873D226C29E9DD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392062, "uuid": "ce69a0b0-ef82-48c3-8474-fa217cf36ae0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392062, "uuid": "c3b198aa-8d21-48a7-8f52-7f5f34f3e3b5", "value": "12288:M0bOoPhb8jqj5rpehC8FLI+/R/wA2HzNR6:TRPWYhpehZImwAUNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627392062, "uuid": "33867c5a-4322-480a-81ad-26b905073c24", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627392062, "uuid": "f7b57ff3-9eaa-473c-814a-61be142f9c56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392062, "uuid": "98711f98-8e6c-4b82-ae78-be3e8f559912", "value": "ad54fbfa5cd265112f67ea1b4d2e95a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48cd0a93-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627375653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375653, "uuid": "aca8f841-4dea-4fd5-b034-afef85439dbf", "comment": "Malware payload (Dridex)", "value": "b7875b3c9f2ea4d250a68b23869776a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375653, "uuid": "dc91d580-9616-47e7-a13b-416f16821372", "comment": "Malware payload (Dridex)", "value": "581305130377c5a6cc8fe10f6e698758da36cfd857981dbb1da867f202429653", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375653, "uuid": "d0c4680d-dfbc-47be-ab65-e244e3b7845e", "comment": "Malware payload (Dridex)", "value": "bb89bdc18c8258fbd2b6f9befd60365ee39f4536", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375653, "uuid": "e335a7c6-0200-4c05-85c9-aa56d584beb6", "comment": "Malware payload (Dridex)", "value": "0c467d4f5256fdef4954c26c37b701048e399affa23ddc866bf01160eadb7d86aec2a4fe9c839381a4a1be08ef91415b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375653, "uuid": "c7c663e6-a062-434b-ba65-089cd549d48b", "value": "T13104D061DBE759C5D7A3C57ACC8CA17BD1293C0B8A6CD27C6208D2CC897AF0CC6A4D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375653, "uuid": "b0cd49cc-4fc9-47a8-8263-1ca14ea9e8f8", "value": "89aebe8644a760ddbd7c2e801228e7e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375653, "uuid": "15d0e78f-070e-407d-bdcc-19b5c1526449", "value": "3072:GMNLuxQI4JTJlYDFS6t2NAgEaakq7MCi6TM7EfNfFln:GM5PB3ot2ygEasni6TM7EfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375653, "uuid": "a258824d-3f3b-4a86-8dbb-436729d3f044", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375653, "uuid": "3764e5a7-47cd-439f-8b09-b4033ae56a43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375653, "uuid": "9ec6beee-5272-4c9a-894b-770d28a2e7b2", "value": "b7875b3c9f2ea4d250a68b23869776a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d2b552-eec9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627383669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383669, "uuid": "1f151684-7abd-45bd-958b-b140b02e5922", "comment": "Malware payload (Mirai)", "value": "7bbfc1bcc9ae9e9037127eea2d949c8d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383669, "uuid": "6f03e5ec-4094-48c0-bdac-19b1c9298744", "comment": "Malware payload (Mirai)", "value": "584ea34ea16c02083beefe0c1e0bc6b63a3426a7c947b105955fd5989b8a7193", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383669, "uuid": "e38e3152-0f0f-4120-95f5-458ee4f92382", "comment": "Malware payload (Mirai)", "value": "abcde2ef3026e444c988bf11c4553603e8d31f1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383669, "uuid": "f917b991-184b-4773-b31c-03fd8e692c74", "comment": "Malware payload (Mirai)", "value": "ffaefde6d217232e6acd5fa236155950b01254c2cfd0aa31bb11bf91e3682ca38588a7b8a2050a616c9dec6290dbc2f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383669, "uuid": "1ad9a627-789c-4f38-a0af-462221e919f0", "value": "T13964F1CAFF11BC3AE985067139A7075DB7B4DA8AC3C7E080F294C55E38A9285AB611D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383669, "uuid": "06c75a79-fcf7-4e79-a938-26f235b61e2c", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioQa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiIPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627383669, "uuid": "1122cd56-cf1c-4ff2-9756-1c8d62370561", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627383669, "uuid": "c95878d5-4c8c-4496-a0c5-e3496064bb9a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383669, "uuid": "cc26dee0-0886-45e2-bb6a-d1cbff99be2b", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed308ab6-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627365621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365621, "uuid": "a9bab98b-df29-4861-8f9c-4c66db95fb57", "comment": "Malware payload (AgentTesla)", "value": "b403f31c76088a2ee2f200fe5a8b1e80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365621, "uuid": "9f1649ad-c7c4-4fd9-9961-a50317cf5392", "comment": "Malware payload (AgentTesla)", "value": "5850cb1649be858dac8ab1257f861dc8860351ab5ba15fdb24cc200cff6b3289", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365621, "uuid": "f4d08f8c-8e8a-44f8-8452-e42a8aa1a8b4", "comment": "Malware payload (AgentTesla)", "value": "67b23a699360dff5721c996b6451a8ee5663b7fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365621, "uuid": "9f5c4906-8bc0-4b02-b407-9889f51945b5", "comment": "Malware payload (AgentTesla)", "value": "38ffb2c0f2a4424d0b2ff1a05c6cb81c5d4b52df2e230fef8b4828ce461dbed50204f2308e0877515a86e26ba0597ac7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365621, "uuid": "95dd4124-223f-49a8-92d3-70671552ab09", "value": "T1B12523C50F4EEE1ECDA60C1ED6BB2F7491B51E3840AD026C1694B8E2ED78F45439DE68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365621, "uuid": "91f74b84-47f4-4939-9e99-1d554dd69f0a", "value": "24576:k84/Mqm+Crs2ekBsVaBCCOhVbQDHWbakw8P6uRCgxXMZNxr:kbkqN+9BIhkeRw8P6uHUbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365621, "uuid": "bbb0a18f-1ae3-4802-92b7-d105723b8a0c", "value": 962856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365621, "uuid": "c3dd4fed-9c49-4db7-abc3-f37b1f9f7af6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365621, "uuid": "892e4f13-95fb-4e40-8731-14b1f36b7b3b", "value": "COMMERCIAL INVOICE AND PACKING LIST - SHIP CONTAINER DOCUMENTS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44db847-eeec-11eb-875b-42010a9c0053", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1627398650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398650, "uuid": "8340b92c-973d-4835-9af6-1bad791c8a06", "comment": "Malware payload (RevCodeRAT)", "value": "97f7b44b25caa09ab9a31dcc3b998552", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398650, "uuid": "570df9a9-1a13-4038-988b-1057c6364e0f", "comment": "Malware payload (RevCodeRAT)", "value": "58949b34eb0f77b45800e72a3ef31e9ae61725a4fc8208f5a718918094758485", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398650, "uuid": "cd329c9a-345d-4775-8e1e-bee424d890a3", "comment": "Malware payload (RevCodeRAT)", "value": "8be55bee43db8fff7b7cca8fe501934d7762e451", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398650, "uuid": "b9f6a09e-f3f9-4c5f-b7ec-7cec7f9b108c", "comment": "Malware payload (RevCodeRAT)", "value": "c9fbe51520dab89d285e03cc66bf553c907754a1c5f9f96e493fd504f025f1f679897da484dc29d5281ee77654c261ab", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398650, "uuid": "f720a0e5-975b-4192-83e2-884105aa06ca", "value": "T1624533499BF22F2E1B1E34B0F76F64FA338AA509D47DCDE0AD1C45D0AAF6D291403159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398650, "uuid": "6859bf16-d2b4-4799-90e5-b27663675cfd", "value": "24576:/4aVhAbhPvp9b5f1fPhFsO6Nc9hRnOn5JMtuGr7GMoAxsfW9UBU:/ZAlPvjzPbsO6+9hRnOrMtu67aY6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627398650, "uuid": "f19dab12-05a2-40ec-8478-e3f2834c84d2", "value": 1266087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627398650, "uuid": "4f610b7f-f012-421a-a5b5-41ff35c64dee", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398650, "uuid": "fc484e52-9a47-47e2-9dea-60fb142cc3e6", "value": "HSBC_PAYMENT_COPY.pdf.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257188b7-ee81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352401, "uuid": "b1398ce0-01f2-4600-95db-f32cf719206e", "comment": "Malware payload (Mirai)", "value": "428cbe789b0d9a77570f95c550115984", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352401, "uuid": "b4914537-4365-4624-aa05-966ec7a92111", "comment": "Malware payload (Mirai)", "value": "59f24cdd2e944f9955c0b54ed179129b33dc1fe0a55b823af36f47db7b627869", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352401, "uuid": "32dab39d-235b-487e-a924-b1c81a438c4a", "comment": "Malware payload (Mirai)", "value": "beb7110810d13e88bb567233c035df255b86c307", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352401, "uuid": "229ba2a2-e147-46f5-ab3d-d7ffb93c166c", "comment": "Malware payload (Mirai)", "value": "2f98a7c898bac5bc1f962ed5ee78864435545cc24e75fcb68c55d96b5950eba6b42f76261742b1857c34ea30aa2dbdc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352401, "uuid": "b2bd73ff-5a1e-423e-9c10-b1586eb8f19d", "value": "T15E53AFB6D4949EC0C609437870708ABD5723E9467A1B1EF09E4989AE400FEDCF25D3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352401, "uuid": "419df89c-a69a-4748-bb58-a3cf668db199", "value": "1536:6/i6bYdjaeOqtb43p8rj9/tqWgj0KV7CoHgx:6aVlDtb4upLgYKV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352401, "uuid": "0d294cf3-9971-40c7-b591-dc44551c9421", "value": 66596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352401, "uuid": "9d2f1f4b-2a00-497d-95e2-cf57d3110b2a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352401, "uuid": "4ec64f2c-e60c-4120-845a-18a2e1ad9cc1", "value": "428cbe789b0d9a77570f95c550115984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95862a0-eeee-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627399491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399491, "uuid": "b5eb1600-747c-4cda-b969-e9376288b5cd", "comment": "Malware payload (AgentTesla)", "value": "dbf6a8d2aee3ee5ba2cd2f88e567ebcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399491, "uuid": "347a5634-b016-4aba-a1e0-b5df3f169249", "comment": "Malware payload (AgentTesla)", "value": "5b8456fbfb62922ce7383ffb8e070c0524768a40bda22da415640128baef40b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399491, "uuid": "8146fc2f-1914-498c-aef1-10ac83646fad", "comment": "Malware payload (AgentTesla)", "value": "9be4bb39f0c58b83a4f5571c1fb08cd6e2445a4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399491, "uuid": "dc0c4908-0ea9-4e32-a0bb-228c1bddafb4", "comment": "Malware payload (AgentTesla)", "value": "60c356bfc344021caaa5d037fe50cdb1036fa2c1ecac4a2061d1f522486098ac761f99d54a4b2c0f921f6efa846b0686", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399491, "uuid": "1f39617e-1496-46ed-b0ec-5ad47e9c9aec", "value": "T136F4CFF4163CBF1BF0BF07BD907040629BF050ABC969C7D8FF6651EAAE156A22055683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399491, "uuid": "c1fb489c-a6e1-4209-868c-d1f9c763155c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399491, "uuid": "6b4dc014-48fa-47de-91aa-cbfe5924e869", "value": "12288:r55V/jqCMqmw6/uOsBgo0q4wMnw0MJKD74TK6JHsk0fKkQM8aozDWh:rcl/uOsBgo0q4wMrMJa74TK6JL0fb2Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399491, "uuid": "d3e3f7bf-4fc6-417f-9860-5b0876314d1d", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399491, "uuid": "c0206e02-45c5-456b-b4a0-ad46e6e1c922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399491, "uuid": "6793cd43-a4f8-405f-b881-e15d370162db", "value": "DHL-AW1258901FE2021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9c0152-eeba-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1627377213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377213, "uuid": "2cdc0047-eb07-4530-a64d-3e42caf931ae", "comment": "Malware payload (ParallaxRAT)", "value": "c8fef9f26f288684e1dd99e495dbf775", "object_relation": "md5", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Key 4 Solutions s. r. o.", "colour": "#DE56CB", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377213, "uuid": "c96b60d3-ef1f-4a89-ac78-cd60f5ae0428", "comment": "Malware payload (ParallaxRAT)", "value": "5b9eef2199515e5bf4cd00a176b35747f8bc9984183213fec864aca2c1918a70", "object_relation": "sha256", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Key 4 Solutions s. r. o.", "colour": "#DE56CB", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377213, "uuid": "cffd00d8-9a18-4828-82ca-81164f7d2533", "comment": "Malware payload (ParallaxRAT)", "value": "e9d7952470032a19cdd79e01cdcf6e6762c8ffa7", "object_relation": "sha1", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Key 4 Solutions s. r. o.", "colour": "#DE56CB", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377213, "uuid": "be061ae8-a900-42ce-a076-b29a80de5faf", "comment": "Malware payload (ParallaxRAT)", "value": "a06a4fd048f6639f0ffe58469556002919c64b5660ccccf41199edcd017d7716159bcedd6d7f6e07379eb76978d5f4fe", "object_relation": "sha3-384", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Key 4 Solutions s. r. o.", "colour": "#DE56CB", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377213, "uuid": "aec1080c-4527-4c7e-a6da-500dc2ce3fa5", "value": "T10F667C22F244963ED49F0A39442BA664993F7B313923CD5B97F4588C8F365817E3A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377213, "uuid": "af90c4f3-1879-4c37-9202-b74de0fc5960", "value": "ef55257d8e5414c1ada866422d7543c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377213, "uuid": "0db404f7-4f98-498d-99f7-b994bfbb5f72", "value": "98304:pO5VI/yA/FFrWw//NtM/SmfGnp3b0o5O:eI/D/M/SmenP5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627377213, "uuid": "cb7e8123-f96f-4253-9992-f49fcfde1634", "value": 6852072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627377213, "uuid": "a1ec3dec-71ce-4664-bd57-632eceb28e8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377213, "uuid": "bd8561b2-12c2-4f29-85a5-a1bf116535f0", "value": "5b9eef2199515e5bf4cd00a176b35747f8bc9984183213fec864aca2c1918a70.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6019186a-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627384711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384711, "uuid": "8e826e3f-1020-4fcc-8711-4afd128ed405", "comment": "Malware payload (AgentTesla)", "value": "718013df80ee2f710c0502069f243842", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384711, "uuid": "07b9d7cd-89e1-4f85-ac51-95b5f36da21a", "comment": "Malware payload (AgentTesla)", "value": "5c602bf190d06a7b541c9629bd48bb63745ef463c24e572c7a285f9891e507ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384711, "uuid": "3e32ed9a-57bb-43b0-a296-3e1ee0dfb18d", "comment": "Malware payload (AgentTesla)", "value": "e3f9aed868b39935f0c4ba1ba37e7673879579fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384711, "uuid": "7f2a0b35-bf67-488e-93e5-6fb0cf2add32", "comment": "Malware payload (AgentTesla)", "value": "cc009553ab42c62e972e69137605ab8bfbbd141ec0cc1453201a22571dd637ada0d6dede35fe284b4af917de0be0bbcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384711, "uuid": "74420785-1a29-4d37-9e9e-bc95d6f1d587", "value": "T16EB4231177BC889A2257051F906A8B3DDCFC9FA1A5D8E775887C374FC20B2A9606C3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384711, "uuid": "8cdc8731-2b09-4e92-b1db-e6ba9e32e1ba", "value": "12288:kVsUj2PP0rbqGmvM5DdplfZha9tsU3B/DbGnzrPLHmsbpVdt9iHO:k5KPlvk1f/qB/XGnzrjdbtGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384711, "uuid": "ca530d49-69ca-4844-abcb-89f15b3af87a", "value": 504901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384711, "uuid": "0da63b84-e6e2-4b8f-9536-f889feeb9306", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384711, "uuid": "e6352dbe-3245-4b27-9a1f-5e566cff2982", "value": "PO.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21426f45-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload (HawkEye)", "timestamp": 1627372150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372150, "uuid": "06d88983-a851-4b2b-9a17-7dd7b1f70901", "comment": "Malware payload (HawkEye)", "value": "c37d902c03a12a87e5394f849ae966d3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372150, "uuid": "4572d8be-eec7-44d3-83f8-818f757a1c72", "comment": "Malware payload (HawkEye)", "value": "5c783a84eb7784ccab875c4ec73f44f99a6e443ef7c5dcfaaaa9f2e23f71e072", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372150, "uuid": "232fb5b5-2c56-448d-af3e-1d0e4d493924", "comment": "Malware payload (HawkEye)", "value": "8b4a32210a84fe179b97b211e05bccec0a377789", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372150, "uuid": "04ba1be7-0c41-49cd-b597-04774bb492c1", "comment": "Malware payload (HawkEye)", "value": "069d1d21d035edcbf1aed24ab78ec867dc6a5b830892771e216f668f647e0d2c02cb21206ad77e8e16c48d610138894b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372150, "uuid": "50e4eecd-6296-49f2-8423-61c42468a95e", "value": "T1A79568F0AD01D4C1F57E5B6AF2FD3948A1343217EBC94A4A00E7E6651EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372150, "uuid": "d8d7e728-6003-4473-ab48-8c8c005e4789", "value": "12288:D8FdYzXPvrXYFBSyTZHVo3aJRsi0CTrw6giF3nA:D0U3rXYFBPTr8ajs9QRlFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372150, "uuid": "1e1a797a-cddf-434b-8b97-46be537aaad2", "value": 1957613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372150, "uuid": "6f50e3f5-69b6-421b-a2b6-319e8e59e2a9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372150, "uuid": "8aa118b9-b44d-4818-bdeb-8dfbbe4783a5", "value": "R2607210998764553.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad0b9e2-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627400486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400486, "uuid": "2c04735d-4552-498b-846a-a957a335b24b", "comment": "Malware payload (Loki)", "value": "96b09a7227379467f64b9ca40721b76a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400486, "uuid": "4aa2de7b-9d9a-4f82-8dfd-95d1d688f462", "comment": "Malware payload (Loki)", "value": "5cd560ec7db038e75c705546d41801264cf450d601cf9b1835826da7597ef921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400486, "uuid": "c3a0893f-045d-45e4-9faa-5a48cd420030", "comment": "Malware payload (Loki)", "value": "8a28222904f910de66d2620ae4b99d98c322bdb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400486, "uuid": "d682c3ed-6b0d-48a8-8773-6b0655e59a0b", "comment": "Malware payload (Loki)", "value": "e3545231e22c5b39ec776511493f7b64e396195d45c6016a330bb8b6ee6355611a65e48e75419c953b7426b921f3436b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400486, "uuid": "b1591273-db7d-4874-b973-80cde28d0ba5", "value": "T15A75E80C6DDEB26BF65B11BC356C10E85066FC19C708ADB7AE0ABBF67062E95503B047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400486, "uuid": "375b05fa-3f38-484d-afff-c0ad0a5d4f1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400486, "uuid": "e5864b36-06cc-4a39-84df-f851343f58bb", "value": "24576:VK9lW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+huX:8WiecvIh+am9WPNQuiNB/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400486, "uuid": "5b342a1d-5f60-4e5b-992b-8936949cd589", "value": 1576448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400486, "uuid": "e0ec8a38-2d1d-4286-b4ac-39a1b83a3ab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400486, "uuid": "0feddbe3-5457-454b-be35-6953aa37464c", "value": "96b09a7227379467f64b9ca40721b76a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729e20ea-ef19-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627417814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417814, "uuid": "8e9a0f4e-48be-4e17-a10e-3fd0d9caaceb", "comment": "Malware payload (AgentTesla)", "value": "c2a78d097da563f35e0626d697535dae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417814, "uuid": "0f10edd8-e23a-42c6-8389-889a80d9496d", "comment": "Malware payload (AgentTesla)", "value": "5d132e1c970e448e1e65657a7990e0c894f79ec3588ea32b0e110fb01685b4bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417814, "uuid": "b0dba99b-d771-4305-94b4-dbcfa30b98ce", "comment": "Malware payload (AgentTesla)", "value": "e2b40d9bd7e37cad70a6a6f1fef3ff9d1545f833", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417814, "uuid": "e342a42a-a38f-4c82-8195-a0727f4e1de8", "comment": "Malware payload (AgentTesla)", "value": "5015dd412b1763c1d1120c43f8432f01be7f8f61d50a6fe87c556df72b1163db57f85f4175853bbcf2be950a69da9c16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417814, "uuid": "591b1718-5372-4b29-bf4d-d97b7b566229", "value": "T143357B1023675F98FC7EABB96038000457F5F80BD32ADA0DBDE610DD5691F968AB6B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417814, "uuid": "7ff9d3e8-48e8-4778-8b46-bb3d1f010f80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417814, "uuid": "3c9929cb-1cb9-4782-8e93-102b9e90fbed", "value": "12288:4iyeQB/MpI5j+3QCTx0GyvUIZbVUKwscMANaEbzBwsihQYAelCOV3JeEE+K1D:wj+3CVvDB+lNaMCsgrAwCpEE+AD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627417814, "uuid": "3534635b-b8e0-45c9-9ad0-ca7dc1fd32a2", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627417814, "uuid": "7c9e2804-fc02-4fa8-a82c-aa91ae44d5c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417814, "uuid": "1143edd7-019a-44f8-a823-27ca3c985c2e", "value": "PAGO FACTURA 3802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d8f32e-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627400205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400205, "uuid": "0d7bf4ef-30d5-417c-9c76-ca0d1bfa6232", "comment": "Malware payload", "value": "3e76d5e5209f09cce87ae480ec638973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400205, "uuid": "aa04d5f4-7735-4248-9cb1-a474d297315d", "comment": "Malware payload", "value": "5d14eab845a8914d05943e187edf584889e8b82ba68806079c7f0e9c540d9ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400205, "uuid": "f234cbb6-a47b-4cd9-bdbe-f8a01150d542", "comment": "Malware payload", "value": "cfc7ba2f0c4b60efd7d255dce90cbc73a53a9960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400205, "uuid": "3d363019-74f5-4845-975b-57532366e14d", "comment": "Malware payload", "value": "758d8c6623a75681e42a36abe0edcb62ba2f248dd45db5f2cdd0f8628038085290897431e291ee0889514beeee95a7b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400205, "uuid": "fd40aa75-b976-45c2-8e2e-0e9a10895d2a", "value": "T181653382C438A045FCEF103A1D21E6767AC70A67D1EC29249E43CD2B1DDEB56EE76523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400205, "uuid": "44861b3b-437c-489a-8adf-0c37814e76cb", "value": "24576:Z7dw9OHwuIU0XqqcKA3KpKL+jz+SZEFp3vg7iHHWmOvgpwrYTaDN+p0Y6Nift6QF:Z7cNuGXqqcjPLk+SZYI7iWxqwrYZuNiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400205, "uuid": "17b8401b-5fa2-4b4a-ba05-03550af1ca3a", "value": 1465103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400205, "uuid": "f1273c82-da90-45f6-9301-0f1cd66d7cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400205, "uuid": "bc313454-167c-4e05-9f14-fd5d0e7257d0", "value": "3e76d5e5209f09cce87ae480ec638973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd420f1-eefe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627406100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627406100, "uuid": "8f5768da-c4ba-4e45-a7d7-5c75d6280b99", "comment": "Malware payload", "value": "cf43b0fc3cf4393bb542bd212a1af029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627406100, "uuid": "35bf2263-7ffc-4d18-aad2-0964675b308e", "comment": "Malware payload", "value": "5d7566ee48f7c1525a1d0e5cf2e5463929d7ad9fe55519acec2a4fcb19507f7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627406100, "uuid": "8f84261b-4970-4056-8db1-243d1af0c3a1", "comment": "Malware payload", "value": "44ff1cbf0831d6176bd6e98a46f354800e9d09d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627406100, "uuid": "be957652-83be-4b90-b113-6da227c7c347", "comment": "Malware payload", "value": "848b7d5d6072dd143413345dc7fb39e8500cb5d556702c78c43dda21546a0668b4b670fde47b260a3b07d9d8b346c758", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627406100, "uuid": "11b3b204-2596-4c71-a03b-48b8c209749c", "value": "T17215EF714450D8B5D92B0DFD487237C96EA6E933C3045EF1626B3CADF8A62808BE91D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627406100, "uuid": "daf5494b-a3d3-436d-bbe2-cb50948773ec", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627406100, "uuid": "68cce4f1-2409-45cb-9478-cfbe6403cf24", "value": "12288:++MO8FsF87bhQxUKKKVxeN7Tz6M0qJOIOIuKszuzZNAW5yBlV/DsDLrEzNYwDW:++MOQW87bhQxtVUN7TzMEu2SIyw7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627406100, "uuid": "10c4e779-d65d-45d6-9193-2954edae8743", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627406100, "uuid": "fd21cf54-1c3f-4c5f-94be-9d6fc371f043", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627406100, "uuid": "7359081e-5213-4505-b158-a9611528d7e9", "value": "Picture.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c38014-ef16-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627416749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627416749, "uuid": "d486acab-0e52-4663-98bd-d6a18c70bb38", "comment": "Malware payload", "value": "0d4b6d93b2c7624ac7ba28315445380a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627416749, "uuid": "2395a37b-f564-4921-b841-b0d419880621", "comment": "Malware payload", "value": "5ed35d6d4d4045dddaba338ea5d2858a699e1cafa80077151ad6d2923121af8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627416749, "uuid": "dca848f8-4bed-4e8c-af0d-a31da08ab2a9", "comment": "Malware payload", "value": "df99bf7d6297a448aa27e4c6e5676d0a1b43a5c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627416749, "uuid": "8823e6c8-95c7-4c7d-a93f-6813d4377594", "comment": "Malware payload", "value": "8aff9b11ec008b54ea104ac095b5fc45124b1199d08d97ef64d9bfc55e0eb1ee8b6eca09064b3434e2ab44d29b326ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627416749, "uuid": "a6dd9836-544b-4026-89bb-bc70f7369aea", "value": "T18AC438AC315039AFD633C873CA64AC10FEA024B7A307CE079153159B5E0E6579E5DEAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627416749, "uuid": "2bc98d0b-5d23-41c4-a244-749a5978dc71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627416749, "uuid": "6d09b379-5af0-4d1d-834e-391fcad96537", "value": "12288:xYoWcyPyTbAnZrjrS0lXHawTMXRCwxNkEE4TZb5IL17iToR705jeIpb:xYBcyDZn20liXRCwxNHTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627416749, "uuid": "ec9029f0-7316-4ed8-a330-437a2df7362c", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627416749, "uuid": "d8a6f506-2e20-4eab-b281-c6d5c2196a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627416749, "uuid": "05550afd-010a-422f-9d66-a3af00a9590a", "value": "Factura comercial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3871a94-eeb4-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1627374597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374597, "uuid": "f6d2c4a2-c1e5-45a4-8617-c297249c6f2d", "comment": "Malware payload (GuLoader)", "value": "0982098712c5d11babbcde65cb2d463e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374597, "uuid": "2758ca6c-9785-4e21-a1dd-6f1253a27fae", "comment": "Malware payload (GuLoader)", "value": "5f22cc700a2bc2c9e61044ca91e052f7305b46310f1b747c665a22655a64ae70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374597, "uuid": "ef8fce7d-1401-4b47-a254-b219ef668660", "comment": "Malware payload (GuLoader)", "value": "bb47419b2591e222388a1453533c8ee21e0fe670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374597, "uuid": "ed63bfd6-e3ca-4c07-bd6d-8f8032f44c58", "comment": "Malware payload (GuLoader)", "value": "927fb136f2ec7598251b7491c76bb0e624bcb85fc49802afa73442fc27466475a4a11fac79414a2ded0de9741c29d92b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374597, "uuid": "08e50686-09bb-4ec1-8329-03dbd5cc7f2a", "value": "T1B52419335C284A14E525BD7B5819264BC31A3A70F95D6F2F6228BB7CF231592D3A37C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374597, "uuid": "67efb984-b23b-4148-a444-c98fb948c265", "value": "986283b4a993506f83eb1b2760b4b2b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374597, "uuid": "b2955ed5-00ea-4760-a74a-827d4fe72e37", "value": "3072:Ec9dkJtdAJr4e1QFMyjhRkE3dsNIBHSdLJEeRL:NeteJbWMOhF3dsIHSXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627374597, "uuid": "8fb5e569-3920-4391-a24c-c968132980ad", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627374597, "uuid": "f2e1f3d3-02b9-4872-bcb4-405fd1b2e150", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374597, "uuid": "4ca05e80-fdf2-4dcd-b4e3-66a9713a470f", "value": "DRINGENDES ANGEBOT BEN\u0099TIGT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4419cf9c-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627366196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366196, "uuid": "761e9f45-f7b3-413d-a792-cd2c0fddcf6b", "comment": "Malware payload (AgentTesla)", "value": "0e0a41f28364e81832bada146082b400", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366196, "uuid": "2e23d9a7-6e37-423e-98ef-42d1c71bef0b", "comment": "Malware payload (AgentTesla)", "value": "611eb78fa883a117865bec870932f11051260f07276f8407afba0831abbb08ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366196, "uuid": "270889ec-6c5e-48e7-9d8c-42c0b234ad10", "comment": "Malware payload (AgentTesla)", "value": "cbcc237450192f6e77c24c1d15271e4f45979a53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366196, "uuid": "2ee9720b-217c-46c0-8339-827e3d83e64f", "comment": "Malware payload (AgentTesla)", "value": "74485e344477c02a517fa73604e5211e6e7d37f61c38bba994793115f24f862734e4e746d1fd2fbbad3acb10405e0692", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366196, "uuid": "5569840e-0aee-4e6e-9f77-89b67264809f", "value": "T1160412E9C8407887287C16FAA98E3A89C5E395A8B4A5FE17E43CD7318054CF7AF78154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366196, "uuid": "232d7c75-eb68-4c46-8528-b82272dac6e4", "value": "3072:g19aJnYK6Mn/mPdCV87EWN/j12aAFSFkplCFIiXHa2gIdZ5ZIWj8kkckoN:g19iYanO1/EyB9OgFIOYIb5ZIo8kTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366196, "uuid": "b0aeee35-e3e0-4b9b-9f2b-22ac5ec4a2ba", "value": 188378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366196, "uuid": "f99c7293-4ca5-4b11-9292-f84a8f96a356", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366196, "uuid": "cee3dc82-29fc-4639-9cad-431062a236a5", "value": "TRASFER SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b765e86-eeed-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627398823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398823, "uuid": "37d07e23-6d09-48f6-9dae-e6ef3a9ae3ac", "comment": "Malware payload (AgentTesla)", "value": "8a56d6baa1eac6ca6208e74591221cbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398823, "uuid": "1c585b37-e661-4380-bcd5-c5da027f2fc5", "comment": "Malware payload (AgentTesla)", "value": "61ee3545921c4ddf2a41826b2425dc43b4902353a01798f5516e9afdf4a10d63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398823, "uuid": "8aa37069-271a-463e-9768-e6230a6dc9e0", "comment": "Malware payload (AgentTesla)", "value": "9f057b5a90fdcee33dc2fa4f8f3424a3345186dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398823, "uuid": "26399109-bfc6-41b5-9172-51ab7bd26b61", "comment": "Malware payload (AgentTesla)", "value": "21e26bb3e25b5b8b90413a105331d7fad4e1a97b2d2d849f391b2fc09d8ba08d4fffa88daf8a7159098273be2b55080c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398823, "uuid": "34869abc-d6b8-4107-a904-4f04a0ffca54", "value": "T155F4DFE402387F0FF0AF0B7E9071806297F0549BC969EBD5FF3714EAAF1669A1051686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398823, "uuid": "3f965e6f-7ec8-44a5-b722-745ea1ce5453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398823, "uuid": "c37793a7-0889-4bd0-a8cf-c75f4e3d7363", "value": "12288:QWyPU9tPU9S4VHUKw8xMOsBgo0q4wMjulDlR7W99ka4fuBWKj+otBCFh0ABFyDuH:QWn8xMOsBgo0q4wMjuvRuma4fi+otC0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627398823, "uuid": "7c69fd8c-99c2-453e-881a-ba2832195d88", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627398823, "uuid": "16584419-b06d-49cb-b3de-f69e9c00c709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398823, "uuid": "f4ccc6a5-87b9-4711-8de1-b47c5897124a", "value": "8a56d6baa1eac6ca6208e74591221cbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcfd2db-eeb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627375416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375416, "uuid": "3b8c5cde-d8c7-4fe2-b600-31f6c4675b9a", "comment": "Malware payload (Loki)", "value": "f3a4f1cc5720b34b682d65f04bd122fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375416, "uuid": "0284d18a-2e21-4f3c-b6bb-4fa17880ecfc", "comment": "Malware payload (Loki)", "value": "61fc463e85fb2fa581c8d7ba3321992bfe69d28dc8ca06660875d8b9e9701ecc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375416, "uuid": "e149a256-d3e5-4be1-9471-35e9ea7e29db", "comment": "Malware payload (Loki)", "value": "9918b2802596f7185e71b21cb9a9ff6001d93c01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375416, "uuid": "f106a5ca-692f-48cc-97f1-eed5145c0967", "comment": "Malware payload (Loki)", "value": "17f6949dc8cf82fc30821d5be1d309aa8ffe6ee135ff6df9ceee37211e1bcedf6b54905da89e1183c446b0435079a17d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375416, "uuid": "6cfb4dcd-02f4-4321-91c8-dbda117b9df0", "value": "T175D4ADE4063C7F1BF06F0B7D907140629BF050DBC96ACBD5FF3215EAAF6A2A61051686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375416, "uuid": "9983d66c-7278-4440-95fc-031328543899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375416, "uuid": "3a8d0cb6-cad0-46ba-a9f7-348df345c95f", "value": "12288:3iCPU9aPU914HpMvK3PGEBAOsBgo0q4wMVlxl80Pmb+J9+hrmfjR6k:3i0BAOsBgo0q4wM7bmb+P+hrCjYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375416, "uuid": "d695a954-7986-473f-991f-3b7574bd411d", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375416, "uuid": "7df4a368-f68c-4305-b1c5-ae0bdbd232dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375416, "uuid": "74298069-00fb-44f7-93bd-fc7f0cf900a7", "value": "f3a4f1cc5720b34b682d65f04bd122fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e16d08-ef18-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627417257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417257, "uuid": "6f681dd8-1306-4e4c-8de7-50bc27c60911", "comment": "Malware payload", "value": "9251c42a618a8db22fd9770b75c6291a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417257, "uuid": "b80aa1a5-f461-4101-b768-7e87a2c49249", "comment": "Malware payload", "value": "62257fbcb2bd2f2cef70271cb1412d424adbd4565738fe29a5942de654f3b0d5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417257, "uuid": "79f1fc11-525a-44ca-ae55-d5ff6e9000c0", "comment": "Malware payload", "value": "4b3f7cd05a3a7610f020deaebd126ffae1aee869", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417257, "uuid": "0eb4e87f-34c6-4d3d-8433-50dfa11e0e04", "comment": "Malware payload", "value": "e4e1e8428d8473f25a7d8425742110582f0dbdf62591fc8adfd1711985959001c514e8dce6ed387a8b592ea24deb7d9e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417257, "uuid": "a04d6203-97f1-4a90-ae81-1a3ac386a29f", "value": "T10C842339B9120FBAE99CC25AA4AA6FEA590F27C0E3C0D3F55E5BF545B491F06D10630C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417257, "uuid": "30d509d3-3d63-484c-b011-14c3812d7a30", "value": "12288:oI46pmsJcRgXPAoc+ZljtOQEb+7aGGl5JIoo:oITZPQb3l5Jxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627417257, "uuid": "eae1ab2d-63d1-43b3-a926-856001318ade", "value": 398084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627417257, "uuid": "cfcf7f30-4b36-4106-9af3-17db8d411d38", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417257, "uuid": "c6210461-6f77-4034-99bf-67300df15ca1", "value": "\u201c\u53a6\u95e8\u201d\u5973\u63a8\u5e7f\u5728\u201c\u67ec\u201d\u88ab\u5173\u5c0f\u9ed1\u5c4b\u906d\u7535\u51fb\u8f6e\u5978\u89c6\u9891.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cbccec-eea0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627366008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366008, "uuid": "be5368c3-cc0e-4cde-b4b0-15ff31b02f54", "comment": "Malware payload (AgentTesla)", "value": "37288b7f602f44b984d70ba24538b9e6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366008, "uuid": "b5c78dac-fd3d-4ed5-a6ef-8b653084aeb2", "comment": "Malware payload (AgentTesla)", "value": "62a295e3551d9c734cba5591cb195c78075d973e408e663e799887a6887d39b2", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366008, "uuid": "d5b005c0-55d9-4489-834e-74e232c4d326", "comment": "Malware payload (AgentTesla)", "value": "192d3b1e13e18c9941752faac2ba1ea1bb444645", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366008, "uuid": "ff4fbfb0-346d-4fe0-852d-9cb7a5c54920", "comment": "Malware payload (AgentTesla)", "value": "1dca4a55bcf9923e97cd3f3c6a08bec99768a532b7ed5040edcd7e1a821ef13903f1363acad8d4f126e515f97875b0cd", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366008, "uuid": "b7e7301c-5738-4c49-883c-74aea84f66b5", "value": "T150B42370833EC152F0A74179AD51501B790C3628FB3B0706859A57F37AB76EAC2A4EB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366008, "uuid": "b2a70d51-b2b8-477c-b000-eb2c47bf98f5", "value": "6144:LIOACiTOGKvEY744Slc/WeR8d/nI0hIc1V3gjufmvt8PQGnzF19HZeFy2H43zz3b:kuiSJF45l5ZfIxcv3XdQGnzhHoqzMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366008, "uuid": "dc71f7a8-e8b3-48b4-8f0e-d9e70b40180f", "value": 521569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366008, "uuid": "8528c048-dfe7-4654-b343-6a4e850a326c", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366008, "uuid": "8ab3739f-39ef-4340-b2f4-cbe4e0a00b71", "value": "544425P.oINVO.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f7555e-eec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1627382221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382221, "uuid": "dc9ff306-3c70-422d-982b-62c7ef40d2c1", "comment": "Malware payload (Gozi)", "value": "231cfe604b1dd1f5dbd2834c35975361", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382221, "uuid": "728a65fc-9137-4f15-95c6-879c55b9a1ad", "comment": "Malware payload (Gozi)", "value": "62e3f86b943e7559b6a5940b869fba85ecece39595977ebe37dc50db928752d7", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382221, "uuid": "b5e42383-ca7d-46a6-b324-4ad1afe3ecb6", "comment": "Malware payload (Gozi)", "value": "7952d32d7a51a844bb553d0f02fdb86348ac371e", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382221, "uuid": "a81ffec8-c11b-4441-b28b-63d220c7d545", "comment": "Malware payload (Gozi)", "value": "010f016793dc46a6b272672ad1f7d9645f814db6912f24ac6e58d1ad3a60abedd581ccdb23ae4a8d3c24a5b493bc69e1", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382221, "uuid": "ed3053b7-1800-4b6b-918d-3093cfc8b1a3", "value": "T110433AD97AD4D847638C6E13FF8EBEE9C27A6C6294C476079144BE4E24B8117D6E0CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382221, "uuid": "7f4a5286-7e59-4935-a895-c960f14d3373", "value": "1536:uuYWNBQBTCC3rE2U5w1oAYWvHWJ/Opg+gr+Y:uuYUBQBCOrE2U5wOAYWvHu/Opg+gr+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627382221, "uuid": "0d60d2f0-1626-422b-ab4a-5b980ff6251b", "value": 58191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627382221, "uuid": "7039aded-01b3-4c9b-bfb3-99fecba8fabd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382221, "uuid": "4dd85196-5288-4ff4-8dcf-91c181710fc5", "value": "RM2021OSO03278310721.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e8b3af-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627365575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365575, "uuid": "6ba3b0e0-1772-4bba-ae46-a3591d9f22f7", "comment": "Malware payload", "value": "cf932d6867660bee19a0a599811ea9e5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365575, "uuid": "2d0437bb-d702-481d-a03e-6977d5296fc2", "comment": "Malware payload", "value": "6395c66dc1cfe053464e71b19d22194617a1746220650e089230b1f9caf29941", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365575, "uuid": "4a50439a-c7f3-461b-8612-13b6429a9982", "comment": "Malware payload", "value": "5bfb73249d701659f24107e0d04599d4d6649e49", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365575, "uuid": "2a9db646-82cb-46f4-8206-48eb5b9dc44d", "comment": "Malware payload", "value": "ac1176c40aed76e171a24f27a4aace066b15585bc2102104123ab18799c2642cb14a30387ae207963fce134dc7bf0910", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365575, "uuid": "591852e4-47ec-4365-8717-c9131b68f9ce", "value": "T15272BF1EF80B7824C13189F7DE6302ACEE6F8151E724BC8D625833BD1C8A95557799CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365575, "uuid": "b8d9a92c-d4f3-40aa-80be-e6ee3ac43031", "value": "384:bL7PzUNk3vaTG7U0EQDSfVMNVHngSWOSbJhhcfHVjMXwwM9:PXAvTGYv2LFWOSlhhcvVjkM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365575, "uuid": "20044b51-88a5-4c6e-a43b-434f14bef61e", "value": 17557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365575, "uuid": "30d62351-fb6d-4188-bb04-f035c690e1bc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365575, "uuid": "0f232d9d-acea-4507-91f3-f2b3905f0957", "value": "Document 1.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617b6e30-eebc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627377842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377842, "uuid": "b8bbd44f-0940-4444-8702-15043eddced0", "comment": "Malware payload (Mirai)", "value": "d825e4e4afe1650f6be2354dc0eb5958", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377842, "uuid": "800a0070-484b-43df-add3-fb16d8874a03", "comment": "Malware payload (Mirai)", "value": "63fc757dee1d62a83db2338d18d8ea485741146e8ddb320105d23a5d0dd69d76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377842, "uuid": "d3df0127-7851-42ff-961b-b5f3f4fe38b5", "comment": "Malware payload (Mirai)", "value": "735d61f565b610fbefbf665ac791b7d12845bb5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377842, "uuid": "844886c4-105c-4aee-8035-3a0148824de1", "comment": "Malware payload (Mirai)", "value": "3d22c40f627a58739daba079012a93234fe9ba871958bf8edf5b10c9d912f285481b69020d8fe8688410ef8a37b58153", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377842, "uuid": "62c3a041-16fa-48ba-95dd-90551cf16b9f", "value": "T1CC53611ABF640FB7E8AFDC3345A91B4638CDA41A21983B757934D528F24B65F05E3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377842, "uuid": "714a1b9b-3093-46a8-ac3e-f311aac3b0e6", "value": "768:nLYeTKkLPlaUtxxJBhoePEut3tE5n2eXeBJeEPcheghzXiTs4u2Rll:n8eGkLPljf3EgC0JHPch9V2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627377842, "uuid": "d894c850-f087-4a6e-8806-77626e0d1451", "value": 63444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627377842, "uuid": "29700ad6-a008-419c-b57e-cc10daa9f050", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377842, "uuid": "54a88055-9e67-4819-8f52-307a8185e7ef", "value": "d825e4e4afe1650f6be2354dc0eb5958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316c7fc4-eec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1627382056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382056, "uuid": "073af953-95fc-4e4c-abb4-5cd93375e069", "comment": "Malware payload (Gozi)", "value": "3e64c99d9a2a523893e9b1da64e2f605", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382056, "uuid": "a92d8a87-c461-46f3-a338-3e707fdb1883", "comment": "Malware payload (Gozi)", "value": "644b2bc164fb1118f399abd11f3e717491ae55560c042da604a9b784fc04c1f2", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382056, "uuid": "f40bf9f8-4929-46f0-b3ec-e44f678afd04", "comment": "Malware payload (Gozi)", "value": "db7a87a3689404360a4a55b40ef29c469086f49a", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382056, "uuid": "8ecaef45-8ab4-4a1f-ae7d-0367229a4b36", "comment": "Malware payload (Gozi)", "value": "491cbe7a03f91b29862ca3738bb355a038553cb02b002123b999dc67cce3f9ddca8fdd9309ab2692ac5dcb00bd9d13c6", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382056, "uuid": "97bf465f-7aa2-474e-85c2-c10fa3043645", "value": "T11142C048E946CCADDD23F1BB2CC87B507767A09039E01E45EF0B3D25679443EFA6A261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382056, "uuid": "014746cb-f0c3-43a7-ad89-4cee51527f5f", "value": "384:Bs0muxW/MKBNWgnJtJqzQ4qoVuMRD1jnVX:BsPuxW/MKbdJ6BXRZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627382056, "uuid": "39a749c4-562e-47f6-969e-98070d633778", "value": 12860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627382056, "uuid": "e3f4d456-a9ba-4e0c-a243-88e067a3cd51", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382056, "uuid": "02dd9897-1a3e-42d3-b79f-7ae660fe9c2c", "value": "RM2021OSO0327831072120210727104835.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7221b5f4-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627366273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366273, "uuid": "0af0f582-eb9f-4316-914f-9306a0e7b8e8", "comment": "Malware payload", "value": "5539a27f8db95b775a51ee37fc47f743", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366273, "uuid": "4efc1447-e2b8-4da9-b3a5-5cd661a7f5c1", "comment": "Malware payload", "value": "64af17b517ebc42654ebb68d855e1311ab841c4c3a4fdeb3f642590a17ef5f2f", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366273, "uuid": "12c465b7-a16b-408f-8147-ec92e8db9401", "comment": "Malware payload", "value": "58f919a00c23b93d33dda437659e732567b0b49a", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366273, "uuid": "a73c061d-4e66-460c-84dc-e8c9bdfed1f5", "comment": "Malware payload", "value": "c96dbd98a4f6ffbf2b5433b8af9a0638feee335e4be61a66f19580fac1fa749d19ce503b9c1ae578c93d3f25ac86037f", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366273, "uuid": "1645334b-fe1c-4fcc-bf61-181ba94e8d22", "value": "T1094423F710D85718FAED1377E29A556BAB760C853CDBB21D8B2C0185A0A6C0D49A373F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366273, "uuid": "b8939a35-925f-4821-89c2-9923caf7b505", "value": "6144:51a6w7uLwjRKzY76iY52eWmd8E6h9X+7hOfn1:51aCLwjqY1a2eW48Ef7hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366273, "uuid": "a703ca02-4b44-4695-afa6-b4901ab1132f", "value": 257871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366273, "uuid": "51cda953-b626-45a6-abb8-efe8d389ade6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366273, "uuid": "0e7f6605-a7e9-485e-a0df-a89a01054c43", "value": "Image.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c202bc-ef17-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1627416764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627416764, "uuid": "cc239f4a-bf68-4ca9-84bd-59947cc38cc3", "comment": "Malware payload (CoinMiner)", "value": "e70025359ef960acb7a37572b0641ed2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627416764, "uuid": "30400e0c-fa63-4350-bbed-3c1e4b2a4548", "comment": "Malware payload (CoinMiner)", "value": "650032961db3668f23cabc3c999e1efddae68bd77a9751de212d8ed9b719821e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627416764, "uuid": "d5dceecf-26b8-4e7d-990c-888fea683ea0", "comment": "Malware payload (CoinMiner)", "value": "a315ab77f2519de210727579b8cf98338144f105", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627416764, "uuid": "84cf23b4-d800-48c1-88a8-a52c25e3b130", "comment": "Malware payload (CoinMiner)", "value": "ae2689cf555930bd96bc1990dde1e8f4886bc5d5816099ac60eccddd49404bb1faae49d087dd22b2f98d3497d04f02c0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627416764, "uuid": "219814bf-3b1e-4f36-add6-b690e5f39823", "value": "T1F5058C9C3240758EC4378E3389A4EC71B6906C66970BDA0358E77DAFBA7C657DF110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627416764, "uuid": "9269eaf0-3868-46e2-bef8-38913ab639ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627416764, "uuid": "ceea07d2-5de7-406b-af07-065f6917a00d", "value": "12288:7WtUZ+FWymQgJbhuhM9vjfvXwYjSddmrHB0W1k3/HQqQ++hyp/TtbtEoA:atUZ+FWF7bUhM9fvgVdmrHB0W63PQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627416764, "uuid": "6d0f0ab4-b769-410d-b7cd-1fdadf1804b0", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627416764, "uuid": "7fc063aa-fe6e-4275-99fd-be2d263d10ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627416764, "uuid": "9ae10840-3dba-4b34-8ba5-b4720e1a7168", "value": "PR4007-PO161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6758c4-ef09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627411171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411171, "uuid": "5bd9a17c-0b54-4473-8df2-6e249228c487", "comment": "Malware payload", "value": "c36cd743c307016c31efcefc5b6aeb9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411171, "uuid": "34e428d4-c44c-4f35-9a8e-401682f75144", "comment": "Malware payload", "value": "65d300a34e66e5532f3a35b641a9fc25048ea2c14dd3239308dc8fe621581b7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411171, "uuid": "2de0c79d-ac5f-4261-93f8-703d5a7a8758", "comment": "Malware payload", "value": "cbf8dcecc92fdfc066d31e31a886fc2f0eb1d74b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411171, "uuid": "516c8046-cc6b-418b-b0c1-ee07723fd918", "comment": "Malware payload", "value": "ce668cce68ce0211230df969f2ccfe4712eeb6af64bd1b9b3f211248d2309e4360aa9b65094e7b7a8e16ab7510179e61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411171, "uuid": "aa2056bd-8ac9-4340-83c4-e3e3a5e0e26d", "value": "T178D2D06259ECA7F1C419A9B63E8D35B95CA9530C8590C2D2AF8CA330DE12F603F17643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411171, "uuid": "97e78344-efa2-42e4-bde0-00767557cd46", "value": "768:K83YNbjlNrGgRuvbL9zSWvfBlnbcuyD7Uryqi:B3YpjlNrGgRuvlznf/nouy8mqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411171, "uuid": "380d6426-5a34-4c79-bfa8-5b6519a7a66a", "value": 29068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411171, "uuid": "ea1f4027-9509-4fcf-a9e7-9a13dcd753b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411171, "uuid": "088390d6-7e8e-441f-b84b-468108f76dd9", "value": "c36cd743c307016c31efcefc5b6aeb9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d792ed7-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627372144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372144, "uuid": "23904c20-6a75-483e-9640-45cff5e8d541", "comment": "Malware payload (Formbook)", "value": "24eba911a46b8a6ccd1c236343ad0dd7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372144, "uuid": "14d7ed41-e59c-4e61-8063-9da3ae797345", "comment": "Malware payload (Formbook)", "value": "65f8af30e604928dbd699a602303550b7cc3649029ee219bf635309e42ed71a7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372144, "uuid": "03b1ec40-718a-4313-ab06-b18c7e7d5c0c", "comment": "Malware payload (Formbook)", "value": "886359cfe688847daa987cf67e863b27e6248715", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372144, "uuid": "c8136547-0984-4f1f-8419-d4517bfa6055", "comment": "Malware payload (Formbook)", "value": "5a7f21b1da6bf16c6a831f26ca7574ea451d454f800aa0d880ea83fa1bce046cc6201a9e6e6957902e53c5f1f8b5fd39", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372144, "uuid": "98b5bc61-76e2-4059-9006-58c4da32e4aa", "value": "T1E873C5BDD58748C8CF866BB82B0B5E55164C362EFB84A07276BC93721BD5C7E501683C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372144, "uuid": "8e721cc1-0ae8-4431-9959-614b445f3c26", "value": "384:5BXercJv9/rsok+PrlZ5Y2fDbmUTM0YnJvC12TK8Mpnq/K3X+:je2R4oDrlZpfDdTMRE2u8M5YsX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372144, "uuid": "03918dfb-e268-4259-9ef9-22393ff0fc04", "value": 75769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372144, "uuid": "810a67ea-dc99-4933-9df9-a24cd29767c0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372144, "uuid": "da9d2cd1-599a-4228-914e-77daf0df7b33", "value": "Correct Bank details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8a7293-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627397000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397000, "uuid": "d44429da-7cf6-4822-8753-322ea27e7c59", "comment": "Malware payload (Loki)", "value": "84ea29c7d6a9ed32225d28bb8f54aa9c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397000, "uuid": "28326a4a-17bf-433c-9be6-9a35caec9829", "comment": "Malware payload (Loki)", "value": "66896b1e0185fe478676b2efc089442230577e7b7b3d62eed4604adbe829f8d9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397000, "uuid": "c7af222b-f63a-43a0-93ea-dd06ffdd03a0", "comment": "Malware payload (Loki)", "value": "c75c6394dfa978671c5ed147ce93a2beec1f097d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397000, "uuid": "01204843-486f-48f3-aa74-e748e466b24c", "comment": "Malware payload (Loki)", "value": "260fbc31f9eb5f8d48fe8b11d4a8d99559e1268f54f7e4c579af045ebf93e8d8151c427f4932f40f81464a55836080b1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397000, "uuid": "2cf021ce-a1c2-4a74-9212-615d209b156b", "value": "T11B45125574C78A06C1433377A42B06EDACFABC1EEC40B62672067B6992F7DF19B1D680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397000, "uuid": "a988efde-3a4f-45c3-b9fe-d51c55ce05cf", "value": "24576:El2ulEYWY0xEN8EHLRaYnIu3YPA3HrdaUhk7Wk:zY0xEN8EHj/YPUdlhKWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627397000, "uuid": "360f843b-b8bd-4a82-a9fa-90c23936d7f1", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627397000, "uuid": "0b4b3cca-c4de-43ed-bcba-235e0af97e94", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397000, "uuid": "025639aa-baf2-49c0-826a-cbce62746d9b", "value": "Invoice PG 008946.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e0be59-eeba-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1627377230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377230, "uuid": "a13ffb5a-1260-455b-a0ed-199f463cf13e", "comment": "Malware payload (ParallaxRAT)", "value": "c6807985e9ac7a2d65b15728934c0a86", "object_relation": "md5", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "BedstSammen ApS", "colour": "#49E4AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377230, "uuid": "69e16d13-adf3-4e19-9bf8-e9cbaece5d6c", "comment": "Malware payload (ParallaxRAT)", "value": "66dfb7c408d734edc2967d50244babae27e4268ea93aa0daa5e6bbace607024c", "object_relation": "sha256", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "BedstSammen ApS", "colour": "#49E4AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377230, "uuid": "aebdd0b1-def5-4778-907c-c367ea754195", "comment": "Malware payload (ParallaxRAT)", "value": "5d9a604584a5052d5bb7b277be339a1debeaaf59", "object_relation": "sha1", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "BedstSammen ApS", "colour": "#49E4AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377230, "uuid": "511d0b75-8ab8-4ac3-bc5d-668c4f00b26d", "comment": "Malware payload (ParallaxRAT)", "value": "f51c9ddb57656c4f823e0250387143a172e4b85595d4e640975f3b3c41a916bce4a93c653f262d0acd17e83b7953aca2", "object_relation": "sha3-384", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "BedstSammen ApS", "colour": "#49E4AC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377230, "uuid": "507c05e5-d45f-4169-b26b-3e2cb4a6c67e", "value": "T10676223BB254A13EC9AE077246738250597BBA7AE80E8C1E17F4050DCFB65711E3BB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377230, "uuid": "87ef9a2c-b647-4ef1-92ea-8b6080dbdf62", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377230, "uuid": "b1e07201-82b4-41f6-bf58-fe28fc9af700", "value": "98304:dSi+jqKoe10ALnZuIsE5zszaBCpadb95BnMxySiwuF8G5L9zQuxe5UYF/e/Bgmvl:cPLZuU5qCCpm9mNiwuFHJGaW8Bg9CxQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627377230, "uuid": "fcb49603-484d-44ef-b6d6-a63acba39369", "value": 7248416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627377230, "uuid": "6dd23293-9ae7-4d95-ad20-416623833b54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377230, "uuid": "a56f7634-bb5c-433b-bb5b-3b640aac7204", "value": "66dfb7c408d734edc2967d50244babae27e4268ea93aa0daa5e6bbace607024c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022b264f-ef0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627411183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411183, "uuid": "0b97f3f5-84c3-402e-a358-4b242b8a13fa", "comment": "Malware payload", "value": "6a3129135335088c78f937a6b72fec4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411183, "uuid": "87009e10-cfa0-41bb-a781-4af95af79c45", "comment": "Malware payload", "value": "6766854561990b1b77f3c28550e8bdb3e1436f3f84857ddd42cc5ac1774476ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411183, "uuid": "9caee0e8-4c3a-4464-b7bf-a8aa8646ce57", "comment": "Malware payload", "value": "f4b955dbb21ef49ce1649aa6eaca730170bfc60a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411183, "uuid": "86302b77-fec0-4b1b-9151-85bc9f2d0855", "comment": "Malware payload", "value": "43c6909b2e7fba871166834ba702750eb2591097f790b68398961af16bd0cfd7295ed9e21a88c26be65a8f2cc66415d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411183, "uuid": "8ac46ec3-8b58-4c03-b4f5-8fd408342777", "value": "T1F9F2E15355D980D2D6B13C72EAE84805264500ADD8FA36BF23442B74BFF788A8DED283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411183, "uuid": "96b11c9b-4e9b-4405-be7c-00b5d0e09e73", "value": "768:SmmQQXodwHN3dZ7xYZFF2EyDvmKIZX+eHGze3U7:RmQQE6j/YZQDvHIlnGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411183, "uuid": "16786d3a-f3aa-4311-afcf-c5e449b25b08", "value": 34920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411183, "uuid": "c7cc19df-2f06-4039-b5a1-9cfeb0eb0192", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411183, "uuid": "061d82e2-583b-4ca3-b307-124b2efc9317", "value": "6a3129135335088c78f937a6b72fec4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841d92a7-ef27-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627423856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423856, "uuid": "2139bf7f-4ded-4389-8132-60aeb1ea8b92", "comment": "Malware payload", "value": "1ca0fbd832f9f7cdc0e50b29bd0d970f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423856, "uuid": "a73f4a4d-d44b-4ded-9273-8ebb825950dd", "comment": "Malware payload", "value": "690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423856, "uuid": "a75d8f03-f2b2-485e-b040-5f67c3505cb5", "comment": "Malware payload", "value": "9be6a2bc9df78f4566e5690e2f1bb696ae96cb48", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423856, "uuid": "f718a611-8355-4f3d-b81c-33160d0319b0", "comment": "Malware payload", "value": "36f0368c89b339c9b37ea644bd688729f2add0d7f2d33623de3c1d837ef1e9cd748d811a51fc79fa74a8af796be15db6", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423856, "uuid": "d2ff3c57-9eba-4c5e-be17-ed637d02d4c8", "value": "T1CDF22811B2E5C576E27A653414B483720E6B3C316BF9408B7F9E16BA5FB12C0EA38357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423856, "uuid": "ae3b7121-dec3-41b0-a40a-a59eba0fd7b4", "value": "44cabbf1889efbd6905efce6c276dac1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423856, "uuid": "60a67ee2-6e08-47c5-9659-7a12130618d7", "value": "768:GvenXjdk1B2hdbS4j5GC/yw1ghCtmnTEDkvvyowV:O1Aht8w1oCmmoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627423856, "uuid": "e1aab463-4b68-4451-bf5f-142864023203", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627423856, "uuid": "4989b499-1e20-41af-b7ca-fd11df89d03b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423856, "uuid": "ed7bbdc7-db4d-4171-b6c1-ab31459f6f83", "value": "690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b285ac-eeee-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627399433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399433, "uuid": "11a8742a-9951-4041-a9f3-99050c1874a9", "comment": "Malware payload", "value": "526587813105260f2198b6541157bb86", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399433, "uuid": "5b87750f-d6fe-4ea5-8456-6e865bb2d58c", "comment": "Malware payload", "value": "6947705ea382569a6b436779fe9b458e11034c3ea28929763ca714f31a13ad1b", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399433, "uuid": "f7086b8e-ecaf-4f29-bad8-a7228afd39b6", "comment": "Malware payload", "value": "96888e8f488953595765f4a350b66e3aacc78cc9", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399433, "uuid": "9af1ef09-d4fd-47b6-b1cb-da1f879e3746", "comment": "Malware payload", "value": "2e6ed1453816d6367568da98fe1aa7f57e625e20cb0330414ab7d8880d6503626a4dccb4cd5fb5f9664b36091d5fe802", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399433, "uuid": "f07e030a-8428-496f-9c2d-6c1b35674aa9", "value": "T1DB039E4BC501640AC173643EC8368AE998D7BC03A0156D4F91EE7A4B2774FDB2B5E7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399433, "uuid": "03c43013-bc5e-4e43-b914-c72b81037b43", "value": "768:v13PW4S0JS00SneS0yS07jS0MS0bS02S03SUCN+yIf+ybVFOYnmXJIRXQTYyBDgm:NzTWs9XMj0ImUQA7ZSX3Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399433, "uuid": "be17289e-5180-4e2a-94e9-30e8bf3cd661", "value": 38692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399433, "uuid": "45332c6e-7676-4547-a0df-591d0f42df2c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399433, "uuid": "62bb9281-cb1d-4405-9736-2f89301eeb96", "value": "swift TT confirmation.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b7c68b-eefd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627405664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405664, "uuid": "126e794e-0cd6-462a-aad3-7aa5678783ad", "comment": "Malware payload", "value": "2bea67be8c5cb1d75e1b30306f7b4a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405664, "uuid": "65b8f64a-247a-430f-a77e-b197bda9269e", "comment": "Malware payload", "value": "699482d44a6cd0c8a5e2c171315d138627e72130d5a3ff9f6bc65b992eb82517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405664, "uuid": "961c97ae-0d78-42b7-a6c5-d3075dd2d771", "comment": "Malware payload", "value": "bd2094cfbfb10a266bd888a3c12bccc561186a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405664, "uuid": "1855e0cc-d3d5-4098-bbc3-33b828db73ef", "comment": "Malware payload", "value": "cb2b2126b9d43e5d65d2b88abe7c25aa22489637f1fc787d515b7397041bec12c59fb0453d563ce167d75341cb9e928f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405664, "uuid": "d4559521-515f-4a72-9f36-70778a8525a2", "value": "T1D605E0263227A118DC3487F55C24D1B12BBEAC2A562DC7782AC8FD7F7D736785AD0680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405664, "uuid": "9ff97737-4622-4626-b844-f877c26517f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405664, "uuid": "ac6ef604-1471-4c28-8d87-20d2b041c998", "value": "12288:x+QyvUIZbVlBPI2VBPqL63JKQ35V6AZgUluL3Su+WwEQr:avDBlBPIOBPqiJK65cAZxlubSlWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627405664, "uuid": "d7e6b58f-2487-417d-8d48-a4183dce9ba8", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627405664, "uuid": "6d692fb6-cb28-4672-a906-ef55df8b37f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405664, "uuid": "276e2ee7-fc4e-4d35-b314-dd9ce03ca6bd", "value": "qqwN5be4oIxaByX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4bccff-ee94-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627360546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627360546, "uuid": "8c7f1464-a0d4-4814-b8e3-57447b0049d1", "comment": "Malware payload (AgentTesla)", "value": "cf8773a4d5b5367a2a44a5a84b87e719", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627360546, "uuid": "4d0bc196-1a25-4ab0-b185-fd24b417cab6", "comment": "Malware payload (AgentTesla)", "value": "6b0bde8e3b951658063f012258ab40464eed901536292332451554d45b8e17cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627360546, "uuid": "4b0e52e4-9cee-4192-83cb-4175157c6753", "comment": "Malware payload (AgentTesla)", "value": "6945c40cbf98599a8659ddb7be1e0baf77b24ae1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627360546, "uuid": "828126b7-3fb9-4a57-8107-85e7dcc7c9d5", "comment": "Malware payload (AgentTesla)", "value": "22d705a34302acb7afc5d7793fdc7df2f12818b58c2431f4263d72cbc216c74dbb83b9cdf9b0f74e6868163e7eb66342", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627360546, "uuid": "9acd0184-62a9-41fb-9d6a-671695de6a81", "value": "T1A064DF097364CA9BE0151370D849CC3F4AB5AA71375FD3DBB2C069EB7622BC56C12A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627360546, "uuid": "a6398268-9f2c-46a5-a62c-7909bfb9f06a", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627360546, "uuid": "5a93b1bb-62fc-4af6-a41b-7124047058af", "value": "6144:Wd53TvpHeIl0OpnODbrg+JcMwBkyezriqUO4nRcPq5P2kIadi75jhKneUXjo6tM5:Wd53TvpHeIl0OpnaJcBknuqd4nnYlaMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627360546, "uuid": "0893ac44-3be6-41ea-ab25-463be6e48fe2", "value": 331280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627360546, "uuid": "a6af4481-9cad-43c0-aa61-5ea0c5e884b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627360546, "uuid": "b777141f-a1da-43e0-afab-c13a99c9de49", "value": "SecuriteInfo.com.W32.AIDetect.malware2.3013.17177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14af9872-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627401765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401765, "uuid": "890311a5-fe2d-4c90-a526-6a6345c4f94f", "comment": "Malware payload (Formbook)", "value": "c50b491461d89171d660abcc9c654171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401765, "uuid": "6d2bf2c5-05a8-4f71-807f-afa41e531976", "comment": "Malware payload (Formbook)", "value": "6db6324fe282260a224e77fff9bdad3240a63d48ac587f2a701785ea69c317a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401765, "uuid": "b3c5d108-418f-4784-9445-7969c0557959", "comment": "Malware payload (Formbook)", "value": "e1cc6e9512546b2a8eefd3741f52c30121be3dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401765, "uuid": "c6314140-e218-4621-934e-89afa6a88792", "comment": "Malware payload (Formbook)", "value": "2a7b764a79522cbd129666d174481fed2f243e120af2744739b7beb8b0029a6605bf8c1064841480c00e642a9c92195e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401765, "uuid": "5090db43-da28-4c39-9f58-e3f55fe3afe4", "value": "T16EE4BEF106287F0BF0AF1B7E907140629BF0909BDA69CBD5FF3305E76F262A65011686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401765, "uuid": "919a0751-788b-4f07-bc07-820920dc781b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401765, "uuid": "cd8a8ba8-6ef3-4ea5-bd70-385e8f2752e7", "value": "12288:fa6PU9bPU9qA/rOHxdJE7khDOsBgo0q4wMcmQuAmPLbpOy6VnU3bhdxAh9dA+hoB:faQ7khDOsBgo0q4wMcmQuAmDbmVnUrN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401765, "uuid": "9bbc298f-64d2-4566-99cb-72da7c68349f", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401765, "uuid": "353563e1-2f10-49fc-b202-651a83dc5876", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401765, "uuid": "1c175f2e-590c-41e9-8397-e4d39c6c863a", "value": "Order_15078.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec326c26-eee5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627395684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395684, "uuid": "804f5b68-6e36-4088-82e4-7bd6086cfe56", "comment": "Malware payload", "value": "353c715ea8ef50d57350290131b835bc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395684, "uuid": "4663b00c-5928-47de-b6e5-a7974ea1b5af", "comment": "Malware payload", "value": "6dd997c225f5e598cb1cfe95b5689a51599cc0f4b8f1dfa610f92a63469c281f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395684, "uuid": "58c18215-4800-42ef-9f9b-18548116a182", "comment": "Malware payload", "value": "1b28e15c69ae4ece5effa20ddd6ade8298b31fb5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395684, "uuid": "98ff7dfa-50d8-4d33-956f-ba3de5d7f801", "comment": "Malware payload", "value": "7925129eed4a64d43594d597898b05755551434cb8e5016d72eac8a17f46248eca4520ee49c685f70b275ec6dae39f46", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395684, "uuid": "7be61597-f026-4b0c-b010-c086b5ebb856", "value": "T197340BE4688F48B2D2499C5E6494B145AE74FEE334C5887223AFD434DF5ABF29EC4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395684, "uuid": "1140d6c4-6d5a-4feb-b6ba-faf7fb3ae95d", "value": "1536:ifjW7qA4b645J/b6lP1Jsvggz3oF5+Y4R9W57JqD1CdzFz76mAg5eeVhMDw5wfLT:ifjW7qA4b646X8CdzFtr5RDAw5wfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627395684, "uuid": "d72aa5a7-c00b-4969-b5e9-b2ff6a9e9c7e", "value": 234642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627395684, "uuid": "d641864e-3b1f-4d70-bfe7-5903832331c9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395684, "uuid": "492ffb5f-1b30-4852-88eb-b504ae5e90f1", "value": "PI 8922.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c97616-ee71-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1627345578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345578, "uuid": "98828657-2d1e-4d52-b918-557de3fd17d7", "comment": "Malware payload (TrickBot)", "value": "8dd7c961c9cdbd69e9a5d86d7809fc50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345578, "uuid": "e030aae5-2488-457d-bebf-9d0ee72fc095", "comment": "Malware payload (TrickBot)", "value": "6e057855e21f4c93a4e3825b9711ca07ccec94fed55dbc20e1d3316b2b3dc549", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345578, "uuid": "4ec9838d-ad81-48c6-a804-98b82f79393e", "comment": "Malware payload (TrickBot)", "value": "f9765d2e54784151519b6d755118edd01e55c51d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345578, "uuid": "4a6b351e-1107-4934-ab56-912d415a9180", "comment": "Malware payload (TrickBot)", "value": "c6bbad5e89f3a1f4b63830514d468bb2158516b61ac1bbaeb50cf6c1df32a23186d0641471bd919e600929a8fbf838e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345578, "uuid": "8290e874-5317-4067-8654-ba801936ccbf", "value": "T157D4BE21B790C036C1AE31306526E77965ADBE318FF587C77F806A7D5E341D28A38B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345578, "uuid": "2c5226e8-7f6f-448b-937a-733a241f9d8f", "value": "c5fccb41822a3f434586ee8cc221f1e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345578, "uuid": "3e376ef3-2f42-4a30-ad39-3d3d4f6aef66", "value": "12288:NRd40nqiQQuVRe+vFIRiEPH8nzjDAL2dUIvltfWZ5QCR8URd5Jr:7RVQQuVdFQ8nzgLJIdt0mURPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627345578, "uuid": "91b6d03d-8821-4585-a0f1-ee8727cfd2ad", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627345578, "uuid": "e82c65e0-4a16-48dc-ba60-96c5befd9c49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345578, "uuid": "f6dbf67c-b769-41c2-9ab4-fa24cb9b41cb", "value": "wfhG.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693d7c39-ef31-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627428106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627428106, "uuid": "2edcb3ea-e0c3-4048-93db-8bd47b3b4fce", "comment": "Malware payload", "value": "f0353c27594e08be39fbcf8c9e51eaf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627428106, "uuid": "2c3fa1cf-daf3-45e9-93ef-96400244f77b", "comment": "Malware payload", "value": "6e6c927afc8340a1a15150f50bd68ff6ec6964928b5e68ffc631a4e245894c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627428106, "uuid": "3666e59e-bdea-405b-b22e-1f1b9a153b49", "comment": "Malware payload", "value": "ca1067bf97d677248def3252d027d87f545f1671", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627428106, "uuid": "44103e33-b85c-42ac-99e4-1cb84f6e75ef", "comment": "Malware payload", "value": "f077eb9a0a0f540466898a733ce3603abc903215f1798c06d8a7f193ae5de9a8ed2ecea13b0458eae50181c2a3cbec08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627428106, "uuid": "383fd4d5-f7c1-41c6-8b07-8bdafb4af562", "value": "T13A359C282303AFCCEC7D4B755869620493F48213C356FEDA7DDA61EC6A21E528FE7116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627428106, "uuid": "3b9ea036-8165-465f-b999-5c7769988873", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627428106, "uuid": "f19cc9e9-dab2-4a0e-90cc-f58618a0c096", "value": "12288:baNNFpjEy2qZvZyvUIZbV5H7I9TFiboSyTgLtlCe7F2eN9P7/xyNPkI6bYV+ntXG:bqjjEy2ysvDBlQFiboSXLtlCGoQjgk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627428106, "uuid": "af1562bf-b03e-4673-888b-99a55312e34b", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627428106, "uuid": "0a186c81-790b-45d7-9cbe-a6daa8e4962a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627428106, "uuid": "8b206af1-1e0b-4ad3-beb2-27570f192a49", "value": "New Order-040201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ae4c7d-eeee-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627399208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399208, "uuid": "7712ddda-4be3-4689-a221-3137b75ed050", "comment": "Malware payload (SnakeKeylogger)", "value": "2b1679e8ba0a15c211922ced9909c89e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399208, "uuid": "c5850c5e-f7b8-433b-bacb-925254f3b670", "comment": "Malware payload (SnakeKeylogger)", "value": "70351038cf49fc5bf127e4f7df1c563ec036293cbc00010ade2364e0ee311a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399208, "uuid": "b972001a-7e09-4994-9c33-a2cfdad41ec5", "comment": "Malware payload (SnakeKeylogger)", "value": "e1ea8f4ecd4b01f87275d3bd13c101facfbe9408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399208, "uuid": "e6a9cf2a-0c8d-42ef-9494-5e9ca400066a", "comment": "Malware payload (SnakeKeylogger)", "value": "3426407f795cedaf8101b03ee154ddb53818800d0e2ac6946d72e755c7bc21ae2eb6034141872cc54df974a8fa35f66c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399208, "uuid": "458868d4-41d1-433c-8673-5c9ed9914024", "value": "T1E1C49DF83539771FF49388BE64745CA2695020FACA2EC792F33341AAEF1C49B9540697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399208, "uuid": "8d93af9c-25d6-4099-90f8-5e53e0828487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399208, "uuid": "b7cf994e-66ef-4426-be7e-04bffe84864d", "value": "12288:3FtowDCyEzuRczAeqUA+NWySj8uWXzx7yVfP4dcV7XiQVyQ7mo5oFCEkv:3Fto4CyEPsUnNW8Jm5PqcVj7mo5oFCEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399208, "uuid": "cf1ac043-248d-4e0e-9fd4-acb5f97232ee", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399208, "uuid": "a119929e-a299-4be0-b8b0-b4dc8c5c3c8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399208, "uuid": "cae9bb04-7195-4617-b299-6ed89160a991", "value": "templezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb04eab-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627372282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372282, "uuid": "7ccd30f4-a70f-4711-b966-6eb715596291", "comment": "Malware payload (Formbook)", "value": "e356a73111bd8756a73a507e79977f46", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372282, "uuid": "442fe9bb-493d-4339-9250-de6721159b85", "comment": "Malware payload (Formbook)", "value": "70a4a1c0f75d27d88394e818f191b10460cbf18a8bf2265ac690ab21e857fbac", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372282, "uuid": "4ae591de-8c0d-440b-8f44-4d3aa9f4111f", "comment": "Malware payload (Formbook)", "value": "dae6bcce9349a323a7fe87cb31b3999347fc101d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372282, "uuid": "988ff8c0-ef96-490e-a724-a010c57aebba", "comment": "Malware payload (Formbook)", "value": "025b743893e9258d8963357c4b39c5ea61a257593f6beb6819fcc5cfbb5b1451eaaf989f4069688a0e0b3dca60780910", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372282, "uuid": "80ac31b6-d3af-4d00-a407-0029267daa3e", "value": "T121451294AFD3C736CB8772F13345D8B6A25ECC00B520CE526166B69CB0F7A26486717E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372282, "uuid": "344d4c56-befe-49b1-8906-f3f0bcf53275", "value": "24576:f+1o7d4xqpnHlydQE5I63QF+XKSOs5zVwDL1gRpLfjCFF6sQHG5:Xd4xqtl2No/YsgpLfaFriG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372282, "uuid": "259aae17-2f9e-47ce-aa4d-dbe436619eb4", "value": 1276928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372282, "uuid": "61dc860c-6cfb-4f6e-b604-96a657ad3425", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372282, "uuid": "4067bcd4-4942-4dae-bf07-b1e9c68d0625", "value": "July Schedule.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c172527-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627375793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375793, "uuid": "6df954d2-bb5d-43a0-a625-e592289d7ad2", "comment": "Malware payload (Dridex)", "value": "6cb632b4c2e9244c36ad740ef8cbfda5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375793, "uuid": "d4f8338d-ea8c-4b1d-bf9c-2ce399fbab07", "comment": "Malware payload (Dridex)", "value": "71fb5ec5a1424b9965bf487a41e24e04e6cd20fb256b283b8262a6592aa90114", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375793, "uuid": "e6a9eac1-6770-40d9-9713-6dd1db80a2e7", "comment": "Malware payload (Dridex)", "value": "5c90034815dc6faf9d14da1536f05a8a9a1d0f73", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375793, "uuid": "b89d61ca-4980-4e04-8eba-623a88bb248f", "comment": "Malware payload (Dridex)", "value": "3e01a21e67424f6d91881c6c911bb7dd85452dc6ea8ba2951f3ad36e1e2439b78b658ca7ebe7066577593109dbf2b2bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375793, "uuid": "2550977b-20e6-4a8d-8cd6-04d69e3ca2ef", "value": "T1CE641249E077C186FE6B107BB9822FC792533C53D6F840B8F734756CC825FAA6AA4116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375793, "uuid": "0c2ff942-9474-4ce2-ad90-810ffa0ccb08", "value": "6144:2J8j+sWRo6tcJhv7Bzg+8h6F493OzNStilC7JZygxEjI:2Jw+Zenzdl8OLzNStBigl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375793, "uuid": "e12f0aab-3cd9-4843-af47-b3e4d6472c41", "value": 337168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375793, "uuid": "3e3b0f53-dfac-405c-8848-438ecf907381", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375793, "uuid": "c9f52a2d-94de-4d46-a5a4-550498badbb5", "value": "Invoice_2457619.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2480f1f-eebb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627377601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377601, "uuid": "bac42a82-1dd7-4e52-998c-7b4fc9b44a0d", "comment": "Malware payload (Mirai)", "value": "7e12ce31e86b3b5fb3740ade1bc8c42b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377601, "uuid": "21b4b6f4-d788-451c-a55f-9b0105c3dbf2", "comment": "Malware payload (Mirai)", "value": "72e4720e4a681f12a1efcb7cd4a0de971bc27b4f7ed64aebaec4e4aa22636978", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377601, "uuid": "983e5928-4363-4be5-9689-4ea35d34c6d8", "comment": "Malware payload (Mirai)", "value": "094e28b77f2bf533a70d72f3a22ebd9320e562ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377601, "uuid": "d790dec6-c931-4eb9-a49e-1a70003d4fde", "comment": "Malware payload (Mirai)", "value": "4cbb9827340484f4f0989928f8484d459a9c0c32368199e77c1e982ef3d7d715ceb79e0079369784ad4bd556cf9d2a33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377601, "uuid": "f2eec1db-01a8-4cff-bbf4-176b14b22f35", "value": "T13C231746B8D1DE06C5D452B6FA2E42DD3B3663B8D1DF3203DD216F113A8A82E1EBB511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377601, "uuid": "d210f782-e6d5-4ae4-bc45-22b45c22580f", "value": "768:29v5si2QtaOyomkGmkywlvfMbCakeQP31PhVyFN2DR95wVj8s/:m5si2ubmkEvHaP431pVJR95cD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627377601, "uuid": "beaca0df-0d0f-43c9-9450-34d7ef1c5158", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627377601, "uuid": "46a50d0b-329f-4615-b57e-f20c78e43f3a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377601, "uuid": "43e5d957-c580-435b-922b-74a2f026eaa0", "value": "7e12ce31e86b3b5fb3740ade1bc8c42b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeed51a7-eefa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627404600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404600, "uuid": "2e6263d1-749f-416a-8b70-73cf638b29cb", "comment": "Malware payload", "value": "a6be00db2846375bca4609defecd7bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404600, "uuid": "e8c75d98-9699-4dd5-8497-95f2fa292908", "comment": "Malware payload", "value": "72f524700194c68a6f78f7d0d984e579b736d328ef5900d34f26773855f25d42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404600, "uuid": "bd93f77b-8474-4a23-ad6e-b41ab78b80b3", "comment": "Malware payload", "value": "b942941deafa2af11fd59731a4bb84808601ef29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627404600, "uuid": "c6822da0-c6c7-418c-9db9-924d84547d33", "comment": "Malware payload", "value": "88649f73e346c8fd89231d102f071c649fe05e3897360d009c37f881eedc1a991d85036c8123130d62840e77775af40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404600, "uuid": "47c02881-bd1a-4241-b284-393221dbb62f", "value": "T15F256B1023675FA8FC7EA77A2438040067F5F80BD32ADA0D7DE610DD1691F968AB6B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404600, "uuid": "68fd9679-4f54-4e31-98e3-e7555fa91a80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404600, "uuid": "fd7ac5bd-cc60-4ae6-a1b4-3d5fedccd313", "value": "12288:RP5XQv/MpIKW2WFT8CJyvUIZbVSRH47aOSowMG32+4fT+pT3e7z/mNoFCWn:b4HEvDBS6SbL32bfKTkDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627404600, "uuid": "94445850-42bb-4de4-b82c-97df7259186a", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627404600, "uuid": "0bf12ea7-929e-4653-808d-e5f9b1388a7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627404600, "uuid": "93dbd93a-ff32-426a-874e-8c7e6511e11a", "value": "PO#2005042020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10ca15c-eef3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401651, "uuid": "b5e1e83f-1153-43e1-9d80-f6f4507acea6", "comment": "Malware payload", "value": "3dff5c2b37da43ac40de3e0d5fa5b357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401651, "uuid": "b305cacc-64ec-4016-a04e-09062d40b1d9", "comment": "Malware payload", "value": "730bfa776152c38152b5c9180061bf02b4b63a62f2f214cf022bce4bda218c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401651, "uuid": "9f076ba0-e141-4834-af21-4bac2507f39e", "comment": "Malware payload", "value": "ad8051789c990e68f850ad5d58bea12e321bae18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401651, "uuid": "6398b337-c632-4a28-9ea9-6f3f9f0bac33", "comment": "Malware payload", "value": "a2b09b22e70933c9dc5f35eed05a7ed88de97d6a12ba4c1499c0625b45496b340f792c98a6af382cc05952e59fea3548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401651, "uuid": "152228a8-0183-4c50-889a-d7db92fc75e0", "value": "T1295219126BBC877BDCBF6BB75AB3819003B5F7156815DA5D2CC522CA4D33B404A62B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401651, "uuid": "3f87bc8d-257c-4c0e-87fb-fd70b1de7dfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401651, "uuid": "a3fb9b64-5e87-43da-a889-b357343273bf", "value": "384:fJLJJ333XyRvEKYsU2NSaTKw+UE5rrRqDfcMv:AU2+BrVqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401651, "uuid": "b5ee5e46-3167-4cb1-8d10-806b55efb489", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401651, "uuid": "02578f98-913a-4d02-8d2c-4491bfe05a26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401651, "uuid": "cfef42e7-6818-4e99-9b0a-16d078877c41", "value": "202107270010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebbd564-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627413807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413807, "uuid": "df1dd855-bfa1-4bda-891a-2d6be070b605", "comment": "Malware payload", "value": "40b3fc289b8d86389fe35a7675677e60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413807, "uuid": "986c532b-cc83-4c10-a6b1-abb1ce0f8964", "comment": "Malware payload", "value": "731036d728b950c9aef1864252dca5afaa0ce8f733e5c66743fce4b87c0e89a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413807, "uuid": "22a0fe29-4952-4dd4-b780-ab184b49106c", "comment": "Malware payload", "value": "4f2a6d3a8ce86916591aec8dfcb85f5c35448eae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413807, "uuid": "162caa74-dcd2-44e3-b73d-7cb50083dc19", "comment": "Malware payload", "value": "72ee9f9fdca17a345bf3f5c12898d1cf641a4893e33c8f85464172bbd02d662ffce3d3d537ca79c3e4cb1e08288bd949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413807, "uuid": "a0dfc0e9-3edf-4f1e-896c-95978a261771", "value": "T1B35329C8A593F8F5DC140978307ABB66AEB3F13B7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413807, "uuid": "a6f3083d-b3ba-4ea8-bd7d-929b20853dd8", "value": "1536:IoRC9170vwHbQXZ5+qXDEuXi90dSW7V/DjObeFt6PuQ4Z9:PC917iwHbQXZ5+qXA594SWZ/XObeb6G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627413807, "uuid": "fdc49a41-4abe-4813-af7b-3bc3310998d4", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627413807, "uuid": "beac9c77-c46a-4e96-813d-8206cd563dee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413807, "uuid": "822000f3-40cf-4e5f-b9e8-97de58798f77", "value": "40b3fc289b8d86389fe35a7675677e60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7ae102-ee81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352389, "uuid": "b2d28481-ecc7-4c12-a98f-5a0671fda939", "comment": "Malware payload (Mirai)", "value": "60673bece6057df273b2bb7281a9642c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352389, "uuid": "6c60c6af-f22c-4901-a71b-03a827809e2a", "comment": "Malware payload (Mirai)", "value": "73539cd210d9b18bd3d440b42a937ba811c10c373282add17cff31372e1c26a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352389, "uuid": "4f94c17a-5448-47bd-bfce-33693c7a54d6", "comment": "Malware payload (Mirai)", "value": "197ad862ea82b3c8775237e11d4ed44bd475b453", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352389, "uuid": "61a414bc-fc1f-42c5-9d5f-ef4b0a00de07", "comment": "Malware payload (Mirai)", "value": "e50602fc5d7b81037c652257cd5f2b29dd2b16a1b40310798388cb7117c4aa01b3258841f106a3a4c0c96328c1ae9f98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352389, "uuid": "ac052aeb-2c65-4758-8a7e-f4a8c6cfb33d", "value": "T16BB2D0953606AD46C2304C31A97F4BCA7A788275E2F72522B8B4423972ADC096C3D3CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352389, "uuid": "51779d4c-9633-4037-9dbb-60a58fd8a66a", "value": "384:0fyzzejR3LQaM4mx/E0QC16yl4gb1rc37qWDJn0U/5QUEhymdGUop5h7L7:0Ab+O716yl4g879n0W5Q9s3Uoz9L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352389, "uuid": "717a1c33-707e-44ff-951b-2053b8e4bb15", "value": 24768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352389, "uuid": "1fd41b45-ef3c-4075-bf4c-f84784aeafc0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352389, "uuid": "f9bbd8a2-3401-4b41-bcd5-7fffbc9ba006", "value": "60673bece6057df273b2bb7281a9642c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391b2da1-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627365319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365319, "uuid": "2eb9b2f1-a8a0-4996-b977-0f7f057ec1ee", "comment": "Malware payload (Formbook)", "value": "f4a464a28dbd5dab47dc03564a5e9211", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365319, "uuid": "f2a49ce9-426d-4511-aa83-8fecb949fa6f", "comment": "Malware payload (Formbook)", "value": "747e90de3fdc97a7fec4245b0298db8d5b97bded1cf19e4b25fb912797899885", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365319, "uuid": "96e0cfab-4e92-4521-85ff-58417a742ee2", "comment": "Malware payload (Formbook)", "value": "9e2b501477965032d06155536acac1a406cd19a6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365319, "uuid": "f4463ef5-e86e-4409-b702-ae17a687cd0b", "comment": "Malware payload (Formbook)", "value": "c67cbd324430e78a447699c94e6064772499912442f5d8845cf33e27c778dccfbf5574acabe698fdafb0c15c4d5d3c58", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365319, "uuid": "829b86d0-6ffc-4462-a419-1fa49cd31751", "value": "T1F7B4231E3ABF780B4EA3E563C5D2FE61979BC47722FD1458206A833EE96335CD409252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365319, "uuid": "5307bd73-953b-4d29-9e74-720334bbfd89", "value": "12288:NOiAd+ymPjZizhZFV0fURfSbzFYkN19oTcUy9u3:YiW+yWChZL4WSvFY+Mcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365319, "uuid": "986edd6d-3345-40b2-9ea1-6e91cd959851", "value": 503108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365319, "uuid": "6fac26ee-c09b-43d5-9459-c497a1e32118", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365319, "uuid": "f39bd027-c912-4e09-94f4-e89268b77a19", "value": "REVISED INVOICE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e1ed98-eedc-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627391673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391673, "uuid": "c2d57864-c831-4b8a-92c5-6a59b3dd856e", "comment": "Malware payload (Formbook)", "value": "bc1f7a65580d90a503efc484dd48c55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391673, "uuid": "810dc185-e661-4af4-8181-6d27b0bee6f8", "comment": "Malware payload (Formbook)", "value": "74c184d9e5658494b42b413566966b5c54d668aa3dd7631df6d7252c0bcdad03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391673, "uuid": "14c2666f-c370-4363-acd2-4410eb7a5a63", "comment": "Malware payload (Formbook)", "value": "af65acb93acce3bfa6c660261724c46e02b5b3a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391673, "uuid": "fed206be-0427-4b49-b8a0-804abc77986a", "comment": "Malware payload (Formbook)", "value": "83190a237ddd761c1b16d98f687b82c5c844d0f61c882396d31bfd4ff8d1130a3508adeec47e0c1b1e6f94a3bb472075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391673, "uuid": "31ea812d-3fa7-4f7c-bf79-af52c7524e9f", "value": "T10915AE7275904837C12B35B95D039654692BEE042F24BA873BF8ED7E8F753907A3908B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391673, "uuid": "d372e913-9e5e-4a9b-b2e1-f257b8726ca5", "value": "c76515f33c28ab06b1b9a160bab156ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391673, "uuid": "98f9e648-0b85-48c2-9eb1-8891476f6f3c", "value": "12288:pobJq+JP+EWEdlI8BmReMgKToOi7Z8mRfqw4cmGmrXMiE4YCFGQPN+BRKa2:AU2+EXdvwReMgtOQxRfqYmGy9ECDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627391673, "uuid": "48cd19f3-28a5-4a3f-8607-9e9f4745befb", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627391673, "uuid": "6cdd5011-0542-4ab7-b950-c859e00b7a3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391673, "uuid": "c353ee58-d384-4815-80a1-f275183a5046", "value": "Tvpsqjokvrkkjtpqmbrrbdjuamqgumvxld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e81d52-ee71-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1627345613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345613, "uuid": "3f7e10e7-efbc-4aa2-8362-bcfe7fa0d7c9", "comment": "Malware payload (TrickBot)", "value": "48c366cf36c7a7cc6f77e8a9266bb816", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345613, "uuid": "b3464fa0-e90a-4ce0-a42f-811c3a52d539", "comment": "Malware payload (TrickBot)", "value": "7559493fd22c60217b62790fa4576988396967b597cade92f288ef39335bee3b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345613, "uuid": "1e74b6f8-22d2-458b-bc29-41d8c14d2774", "comment": "Malware payload (TrickBot)", "value": "1adfe7aa82799537246ac169332da05cab1f04bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345613, "uuid": "2e1532e1-2a39-4c4c-a7b4-316f1e8af2ca", "comment": "Malware payload (TrickBot)", "value": "f3cd86cfe0fdeadeb27703b2aecde482c8b12c17981d2135fa86051913466ba16c32a1cbafce855f8766fa0e02969a61", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345613, "uuid": "b44c6258-74b4-4eca-92d9-19e8bdcbe8e9", "value": "T1ED45BF90EB4411271EC76357AC0266E2A93DC11193813256D99E639C2B8B5DCC3BFFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345613, "uuid": "e62b87e5-0cff-4373-8f13-4c8fd7c2a4a4", "value": "24576:SF718rE+jIbt7Q+GyqhIOqoQgNzOjPJGQCZPW2MyiQV:SF18Q+jW7Q9ykf9JOjPJGLW3QV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627345613, "uuid": "561149e8-653e-4bcd-8229-e866a81de1a6", "value": 1231703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627345613, "uuid": "35c1a482-6f19-445c-b04f-0d6fb5ac69bf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345613, "uuid": "ae80883f-d075-44e0-80db-2b07c49214e6", "value": "details_5908.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab25440-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1627371844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371844, "uuid": "ecbc24ae-dfe9-4321-bcd8-6f455eb9fb33", "comment": "Malware payload (RemcosRAT)", "value": "736f3c1b37dc7f871643e576a85580d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371844, "uuid": "db67bd07-f21c-4975-9738-d11f4f235f2f", "comment": "Malware payload (RemcosRAT)", "value": "75b6c107ad6001f2588229fbfdb96dc998fe9f3e44f8df69c98096aceea9aa73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371844, "uuid": "ea29fdf5-1a93-4d0b-a178-2a2f224f3ad5", "comment": "Malware payload (RemcosRAT)", "value": "7d56fb1757965377236d265de04b3fec810cfe98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371844, "uuid": "35223d65-e84e-4c9e-84e7-4b146fa5c449", "comment": "Malware payload (RemcosRAT)", "value": "19d9723f4ac20096833c74ba683f29d78e8393e3e1b6c1055e6497def7134e73463dda8a19cf3808fea911682bb9244a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371844, "uuid": "05c18361-5cb6-4193-ab5b-73186e8da5ae", "value": "T1E2158C7272815832C22636789C0B93A6A93AFD443914B7C77BE9EE3D9F75241353438B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371844, "uuid": "5239cdb0-ac94-4b3d-b79d-4fada6b929e9", "value": "c76515f33c28ab06b1b9a160bab156ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371844, "uuid": "35cf4d74-dd28-4617-91dd-8696f8f4c0ca", "value": "12288:pobJq+JP+EWEdlI8BmReMgKToOi7Z8mRfqw4cmGmrXMiE4YCFGQPN+BRKa3:AU2+EXdvwReMgtOQxRfqYmGy9ECDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627371844, "uuid": "4ea72037-268e-4db9-9338-90b5c8a8c3cb", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627371844, "uuid": "6bc39024-f849-4fec-bbc5-5a1624176b71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371844, "uuid": "c6d0c21e-f10a-4682-afa5-0940ed3e694a", "value": "PEDIDO DE COMPRA ASHCROFT - 41901E-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce740d2-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627365352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365352, "uuid": "5cde9671-350a-4b7a-a9f8-6f09539f7379", "comment": "Malware payload (SnakeKeylogger)", "value": "3c34a2467fb97d09c2f008fe3b36ee42", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365352, "uuid": "36b27ed6-ceaa-4b02-a1d9-ae8953d26da1", "comment": "Malware payload (SnakeKeylogger)", "value": "766b2bf9d9069f41111159154ccb89c29a5c097d903266637f51dd8478886357", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365352, "uuid": "d52a0003-04fe-49c7-9adc-fa0d241e065e", "comment": "Malware payload (SnakeKeylogger)", "value": "dc25cba4464cbad40e3cce4b4f839808353f1fc1", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365352, "uuid": "76ce09e0-8726-4e79-96a0-79a2b1defafb", "comment": "Malware payload (SnakeKeylogger)", "value": "62c8629cd60086b772aa2d698dc5e1842fbe20da13b6cc25b7d34b0e2619e5d25a2c53080aee4a3ca3ae75d1d9aef768", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365352, "uuid": "8227f3e8-86f1-4e4d-8873-48bad092518e", "value": "T1824301764F622E23D5E11AB42625AFC34A6C4CE473213C4FDDDE8196DE1EB898310EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365352, "uuid": "8044604c-6c3c-453d-be82-2009fc9ca1c8", "value": "1536:V3pXMAXIqcQWjWGhQdaeaNV04uugA7LwapQ9ii7+H:V3pX1YqIhXea44uuVwau9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365352, "uuid": "74d3abad-0c1e-45ce-b5ae-b1825fce4c95", "value": 59628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365352, "uuid": "c3a7aab9-314f-4c67-9a4d-65c8f9f4a264", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365352, "uuid": "2de31a09-d5f5-4558-9e27-bbb7b7d13ed3", "value": "Al Nubla General Contracting Invoice0102.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac20a63d-eefd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627405884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405884, "uuid": "151bb372-f4fc-480f-bc89-da31cb0adfe0", "comment": "Malware payload", "value": "6fc8a7966aa650e9bde3b05dbf553466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405884, "uuid": "a78d1a17-6b94-4798-a435-b66b6767a460", "comment": "Malware payload", "value": "76895d99680852f9ccb3bc6e2bd937bdd76da6dc16b1e6704e804be92f40c2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405884, "uuid": "916c4306-e5f9-4cb3-8029-4c67cf14518b", "comment": "Malware payload", "value": "3b4aa0d3612ba04d0ccd700912b7ba4d685e31d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627405884, "uuid": "d6ad6c75-6a90-4d3b-88eb-eceb9900502a", "comment": "Malware payload", "value": "3ca418a2038412f4cb52615ee70c67bfe019db6dec0bdb44c2cacbe258551622ee82e7832b5801ab5cba4b9f6a60eaa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405884, "uuid": "cf35c860-a622-4cd0-aa1d-19d0a8796fd1", "value": "T1E635523EDB558B63E272C635AA790300F698108333319D5757D32A4E752EA22B8E7F5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405884, "uuid": "2a9cff96-4b3e-4e6e-93ef-e09548db7c56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405884, "uuid": "566493a5-86ec-44cd-9b7b-d3f4801a09a8", "value": "12288:KXxa0s0i3GTbqwMvG8oIoIeegPt6g3AtITaMHPoVJeR:KLhiWTbqwMvVEtPt6g3AtITaRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627405884, "uuid": "194ab58b-4c86-4dd0-8a8e-d5c89df65f08", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627405884, "uuid": "82e274cd-8fc6-4235-851e-780b22ff7316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627405884, "uuid": "45eddc74-2a0b-48e7-952b-f127b2db277a", "value": "July Order 1 jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4456043-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627400744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400744, "uuid": "748fd127-ae71-4885-b477-8fa94899d228", "comment": "Malware payload (AgentTesla)", "value": "d07003cbc330579112e9ed1bffc1905b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400744, "uuid": "385504e6-457b-4fd5-ac76-a007027b96c7", "comment": "Malware payload (AgentTesla)", "value": "76938d4e2c8778bce2177462dd2875d041e69e43036c0b8e3c2f8b6e650232dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400744, "uuid": "7607670d-213c-4bf0-9392-b13ba588b495", "comment": "Malware payload (AgentTesla)", "value": "fb68a99eeb0f33366398b2dbc499a0e74b64d584", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400744, "uuid": "ff7c2eb4-1fdf-4615-92a7-b41c1f8a4a24", "comment": "Malware payload (AgentTesla)", "value": "7acec706e27f7e37f221f62e54d47a6723b99dba5c4e426397d9fd9ba7f68c3ea7bf42a1a5ebf655c241acf0da064537", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400744, "uuid": "6b022820-4f5f-4d6b-9517-4abb0521e68c", "value": "T196D46A6C355039AFD633D873CA68AC10FEA024E3A307CD079153059B5E0EA939E5DDAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400744, "uuid": "06de3bfb-86be-40ac-afb8-56c8a58608fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400744, "uuid": "b85f8fa4-7d42-49b5-99eb-f2255d7e101f", "value": "12288:nbrkx9g4yi4DBX1Iq6utfTz3yeSlIHS8MzAtIH3sW9W3YMOJR5ZJ08r38AYd:bO99gDBlh2eI/8yAeH3Crb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400744, "uuid": "bf47fc99-e490-43b9-b0c9-37eba2e44852", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400744, "uuid": "a5bd4b81-2982-4071-95fa-33180609ee1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400744, "uuid": "bfe86209-fb46-4dd5-99e5-35ddfd88714a", "value": "d07003cbc330579112e9ed1bffc1905b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05576872-eee2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627394008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394008, "uuid": "81aa1700-8592-4a71-9f27-604ca4afea09", "comment": "Malware payload (AgentTesla)", "value": "be85265738633fe3cd59f95bab85bddb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394008, "uuid": "a8cceaff-3f9b-4330-9664-17123cca7bf4", "comment": "Malware payload (AgentTesla)", "value": "7729f33528cbe1b6f4c4f5e695798b1561a2c2c615a88cfbc495254dd93ab81a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394008, "uuid": "a52bd3f3-a97d-4233-9add-dcf48ec48072", "comment": "Malware payload (AgentTesla)", "value": "73b701dafe47b4da709a349dfe24ac87a08abfe7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627394008, "uuid": "b117d9c2-8ced-4146-bb0d-86a735abd674", "comment": "Malware payload (AgentTesla)", "value": "6f759a338ffae58f86bbe207ba0b2b043a5d4d88ed9e429dfc46de88ea8f2bcc7c021523fb31b7b0fee0445222d63283", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394008, "uuid": "e1983c58-0c3a-4438-9ceb-ac235cf9199d", "value": "T17E15492439FA502AF173EFB95BE474AACA6FBB733B07645A10A103464723A41DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394008, "uuid": "d35a1999-e9b4-4862-9525-9108f2f0d8a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394008, "uuid": "d27c8a07-3039-4fdd-b59b-cd2153a3a42a", "value": "12288:0gctLQGSIDpV8nOM+sphsOW3d/qQRlwMfXY1jLxweAJEvBzngedLt0pfgW4kM5lS:0gpKlAp0QbUpfgNMArC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627394008, "uuid": "a2c9cb56-4d16-43ee-825c-a08d36a8fe36", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627394008, "uuid": "8167592d-c2a1-406a-9e2a-876c58a35a5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627394008, "uuid": "61507447-5f75-4b82-9cc1-b043d4baf028", "value": "payment advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508e4239-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627365358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365358, "uuid": "8b5f71df-ce81-4730-8cfe-379e41db6abd", "comment": "Malware payload", "value": "fe54c35369a2004da6eb1f371819cc14", "object_relation": "md5", "Tag": [ { "name": "ico", "colour": "#BFE6A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365358, "uuid": "53fbf56d-6953-4571-9cc5-e317e3e0a845", "comment": "Malware payload", "value": "776c10d4cf6344c77ca84f3421cea1ff523f90ddf491aace3b9b607355a516c6", "object_relation": "sha256", "Tag": [ { "name": "ico", "colour": "#BFE6A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365358, "uuid": "b3965942-4d8f-42da-94ef-282661ca6c74", "comment": "Malware payload", "value": "8f35581460ba3ec7c4602f2abc3fe3101590061f", "object_relation": "sha1", "Tag": [ { "name": "ico", "colour": "#BFE6A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365358, "uuid": "14a53fc0-9dd7-4cce-9bd2-50162486a5b0", "comment": "Malware payload", "value": "2fbda65338f65960a1a42d4dbafbdedb1588fc5472dfde0b653800d1fe68b4d5ecd851ff64f9885b5cf82b274e2d3d8c", "object_relation": "sha3-384", "Tag": [ { "name": "ico", "colour": "#BFE6A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365358, "uuid": "68c8e62a-6e68-4385-8fe2-a1ad00ec850a", "value": "T1BB240BC5E94465A0DD59AB706A36CD3592237EFDA874A42C28DE3E273FFB2D31026053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365358, "uuid": "a8001b72-2bd6-4afe-9c15-0e2a8268f2d8", "value": "6144:gAkzL7r9r/EDppppppppppppppppppppppppppppp0G1:MP7r9r/+pppppppppppppppppppppppV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365358, "uuid": "300f2cc4-2bf2-4942-b88e-f7c2bf81f03d", "value": 214670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365358, "uuid": "56851900-af7d-4e5f-9a9f-00a5dfe3cef8", "value": "image/vnd.microsoft.icon", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365358, "uuid": "61cc1445-c11d-4647-96ea-49459149a265", "value": "Invoice -01 Nazih El Chouli UAE Tender Documents.ico", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fb7c2e-ef00-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627407161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627407161, "uuid": "557c220b-c445-49b9-bfd8-cd0d64fb8df8", "comment": "Malware payload", "value": "12461631c81fa8e11f62afdad7d24be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627407161, "uuid": "5da889da-7b3f-4363-bb02-635111e44790", "comment": "Malware payload", "value": "77d4db3d0d8be6fee0817f5d835f0c904649d78078e6c78b2d7c224026fed3b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627407161, "uuid": "2e8357ca-6386-455d-8235-47a0acc0f219", "comment": "Malware payload", "value": "d8b6b589cc02a865af24f4ae87a2d4ea6b4ae4f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627407161, "uuid": "75bd64cc-d9e9-4ea2-90c1-93d0cab9a294", "comment": "Malware payload", "value": "f8f5422525ec8ec3252d1c1c7e8d4feeb56f724713af794bb768ec450de035027a52c1828f5a6c0548dbb548696110d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627407161, "uuid": "e9c47455-1e4a-44a7-a225-460929fea575", "value": "T18C158D525ECE865EC2684DB69B319C5282315DBA2949F3132EC134FDD93F2EDC89F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627407161, "uuid": "0e8d5cc8-0db0-4573-b4ee-7649c7f3f7a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627407161, "uuid": "25ae7564-fefe-4231-acdf-26d6bf711072", "value": "12288:a9Pno2Z7caaUggavhF2GqF+me0jFqLNVE1vpY1ScSMPQipP56:a5f7uU1e70o5Voipg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627407161, "uuid": "46260e56-3d23-487e-82e3-c1b3836e012f", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627407161, "uuid": "e99c3343-218d-4611-8145-e877d93c0c6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627407161, "uuid": "d107f9e2-fdab-4a36-882a-06057a8c4072", "value": "PO#55442676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9796f73f-ee74-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627347009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627347009, "uuid": "7f24c5f9-3c33-4c65-ae5a-9d8d1902be86", "comment": "Malware payload (Mirai)", "value": "46bc1da501079475ca159c34da965683", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627347009, "uuid": "222b3605-6cf2-42f7-ae93-29f92a501755", "comment": "Malware payload (Mirai)", "value": "77ea6102f693d80428109c7c4d38834be879ea12da6249fbcc55f11462e94e5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627347009, "uuid": "e2d8a459-51f5-4680-b31a-bb85041c9e4c", "comment": "Malware payload (Mirai)", "value": "fdaedee2a0830eb2f1aa269b3f97f3101eb5ed3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627347009, "uuid": "7d6b388e-3ad1-4e44-ab63-d7575d7b4071", "comment": "Malware payload (Mirai)", "value": "37613071bf0a3a9dded945ce5ca130803c5be608a3bc117d1fd9a45e8842e0f11adfa435bb715ee38df011c12f962844", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627347009, "uuid": "7ba848b4-9524-4075-ad6a-11b44d51fd24", "value": "T12253074AFD819B01D4D922BAFE1E114D33536B2CE3EE72129D212F2177CA91B0F76912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627347009, "uuid": "3182532d-5867-4541-9fdf-31f4cc38c842", "value": "1536:cpneHgT/RfhJakhhKD9o1xGwXw4jlN9ltPiauLXbt6U:kTVhXao1xGwXw4d7u7pJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627347009, "uuid": "c7f9b90f-dca1-4f46-87ff-640f56318370", "value": 60904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627347009, "uuid": "aa02a073-f798-41dd-981d-cbae8d4b1ca2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627347009, "uuid": "e7e913ef-2e74-4487-ad51-99a0065c92e7", "value": "46bc1da501079475ca159c34da965683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01766428-eee6-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627395719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395719, "uuid": "9bb178ea-3843-4191-b2d6-243fbc12ac76", "comment": "Malware payload (SnakeKeylogger)", "value": "ee9778dda2890792b7d5af77946a9436", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395719, "uuid": "c45b6699-7ab1-4f1a-adbc-277c06bf96c0", "comment": "Malware payload (SnakeKeylogger)", "value": "787ea1dbb0b03d6454f97c437513294260d4300e0d787745bda191318add10b7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395719, "uuid": "9f75c5e1-6cc4-4c05-a22d-3f93e12c503a", "comment": "Malware payload (SnakeKeylogger)", "value": "bdfec5e23d7ca0a12ca5347c644ea80fe21b2e00", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395719, "uuid": "3d01be74-e683-4a1a-b213-7de4be68f05d", "comment": "Malware payload (SnakeKeylogger)", "value": "3082283d3c324e4f1343fe0785c7136c97daca52372244c48995e373836374f2840bd8151961bb37d629636ddba93fb9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395719, "uuid": "909e5c70-34bf-4256-98f9-31d61da964a8", "value": "T16B356BD441CB1AF3F1CD3A541A50F04E572AA64E50914C6A2B2D9FE4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395719, "uuid": "8b02bafb-8e9a-40f3-bc27-7279557e19d9", "value": "12288:jLR7m/BFlHRrrYckuCDI2LaUbrYcku5dzFZRsUj:RRsUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627395719, "uuid": "3c7ab29c-f2ab-45e7-ad19-2624688496ae", "value": 1068141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627395719, "uuid": "ccbba36b-2b36-4376-be06-96527a1d8cfa", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395719, "uuid": "e5d0a655-fbee-4068-b725-5dda64dfa0ff", "value": "Remittance Advise.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aaa0f13-eea2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627366636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366636, "uuid": "7885c44e-4944-4d22-bbb3-5807e3293916", "comment": "Malware payload (Formbook)", "value": "24de383154bbdc31b305fd25a3ee95db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366636, "uuid": "4f442b7f-916e-4397-801a-a4dfdee96b6c", "comment": "Malware payload (Formbook)", "value": "790898f9518c146e7ffa430b975ee0f5bc162b6b5a5dba008e0572741312bc19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366636, "uuid": "75ebe93d-3311-4e1d-a542-3cdb6e4110ec", "comment": "Malware payload (Formbook)", "value": "7d3be8631affd24746beeec725b4ad0d518805b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366636, "uuid": "2557d34c-9bc2-4792-80ac-b032c1ae5869", "comment": "Malware payload (Formbook)", "value": "b29e38f81bdb053758828326efde77cf03ccb058c540525092692cda7b442c1008b77d065f9bfd18030c684878e5136e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366636, "uuid": "be3ac4f9-7882-4532-9406-5319dfba0569", "value": "T1CC355A2439FA502AF173EFB94BE4789ADA6FBB333B07A45D109103864723A41DDD153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366636, "uuid": "491e0ffc-9083-4951-ab70-5ae045f4063a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366636, "uuid": "9915ed71-bfbb-4903-9b0d-cbb9f68a74e3", "value": "12288:UFSrFvGhVBnqjNl71y4stHj63BZ7If3ewxKunt93e9cjb0cDxHRfffFUqU3zf7vB:UFSrIUB1ejZuJonQYTDs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366636, "uuid": "fcc699dc-962a-4957-8819-fb9657cc1e7b", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366636, "uuid": "31417b0f-1355-4943-972d-2846f1407f0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366636, "uuid": "9fdd0f7f-eb7c-4a32-b714-3c3b3ebddbbf", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b664af9-eef3-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1627401346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401346, "uuid": "933c3526-b43c-4a5f-af20-6c9f915d6475", "comment": "Malware payload (AsyncRAT)", "value": "4623254c01d5f7aacd77ce78329a0976", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401346, "uuid": "a21a502b-b1ed-4f99-a498-ccaae990db8e", "comment": "Malware payload (AsyncRAT)", "value": "79c980bfebcae8726171a7cb2ff931f0da8bad4edd0fd0beb088e32ad1d1c7a7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401346, "uuid": "cb7a983b-afa8-478e-ba51-cb3c66696bb1", "comment": "Malware payload (AsyncRAT)", "value": "10c144749fb54444b65a2cea0f3a18fc08a5a0a2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401346, "uuid": "d851818b-a4c1-4cd6-80ab-3a04f2888e7b", "comment": "Malware payload (AsyncRAT)", "value": "b2ba190946e95f9392ef8bb918bdef5593a0038be6db4f148abab40d7272da54a8e5c37990cf0e8f55bc71ce1cc0095b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401346, "uuid": "98e3d71c-1a09-4dbc-8cd1-954c5373bc6e", "value": "T143F47C525ECF866EC2694DB65731AC5682314CAA2948F3132EC134EDD93F2EDC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401346, "uuid": "d17f9f06-705d-4aea-b4db-e98b4d9b91c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401346, "uuid": "fc1c8116-43d3-4b50-83d0-d09b3d372a1c", "value": "12288:2TCvlNhhd+LC3foecTJgBiRhsRFFSfmSMPQipP5q:2SVd+LCPZ+8qhsRWipQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401346, "uuid": "86097f99-71bf-4a0e-bd33-7cb820a26f14", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401346, "uuid": "d9bbf65b-7390-42b0-9445-416ba20749ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401346, "uuid": "477bb7cd-ad48-46ca-99f0-cd6b40d74811", "value": "4623254c01d5f7aacd77ce78329a0976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6a5bc1-eeb4-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1627374340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374340, "uuid": "74283f4d-a8c2-4092-8834-8397327d1f0e", "comment": "Malware payload (GuLoader)", "value": "5e87c3f4a9ffd138aa668e6da9c563f5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374340, "uuid": "f85c794c-b7dd-4ee4-b533-844ec6523597", "comment": "Malware payload (GuLoader)", "value": "79fa129571dae0686608e304055c70999b04bf723b4b607d0c5d6ea01da48f93", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374340, "uuid": "b65aac46-d42e-40d9-a1a2-d87f27553d68", "comment": "Malware payload (GuLoader)", "value": "6b5d2099852b251fd76244a1d2da8f81436786ac", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374340, "uuid": "9585d4f6-b5fc-4da3-bc09-78cfdbe6ee71", "comment": "Malware payload (GuLoader)", "value": "8eddf7a0b06afe177e1f3f71447222ef60f3be84beb3548b07f3583217b6b65eebb1753df88574b6d50a3450a4ff7d13", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374340, "uuid": "b44cb30b-c680-4569-adf9-2d17ae3cfe6a", "value": "T1A183120CCCCE14A1CA5B826E84F172F0FA6445B6F57E6E5663476A4D5F49082CE2C7CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374340, "uuid": "73e71334-d0fe-452b-993f-c3c0deaf02be", "value": "1536:V7TtBtC4MWMfeQRtgggggggggggO/dL7ZtGBUw4v46UWGFiyHG7V18nfNy5Menb6:5TtDTMW4Jtggggggggggg4LFtF4zWugi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627374340, "uuid": "176cc180-c06b-4747-b69e-8b8218565a7a", "value": 82956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627374340, "uuid": "c751104e-f2eb-4022-b39c-877277506137", "value": "application/x-lzh-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374340, "uuid": "7988f952-daa7-43f3-9c33-f653ce60ae23", "value": "DRINGENDES ANGEBOT BEN\ufffdTIGT.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8cdc6f-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372087, "uuid": "df5adb3f-dfaf-4e92-8f5e-6a5fd502e7c2", "comment": "Malware payload", "value": "7574e59a8c06150dd3224ac2dafd95ee", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372087, "uuid": "459cd7b1-c2ae-4cf9-8263-c547c2b4c7c6", "comment": "Malware payload", "value": "7a13cc342d0c67425280aabfe4797e4baacfc94f4b042d26ae64e9e488190e61", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372087, "uuid": "8a7899f3-fc88-49e0-a3fd-5dd292f503ac", "comment": "Malware payload", "value": "f29b6a7a9e65b8ebe4167685db51190cdde15f01", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372087, "uuid": "edb95a89-fff8-4b53-ad65-67bcb0baf7df", "comment": "Malware payload", "value": "c55f29f2824e7311ef48631ccee660e52a85b9927d245ef37d8a245ecc98a615460f502ac4f78c18d9133e6723a79bb4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372087, "uuid": "65fde64e-042c-45e8-b776-96680c972a95", "value": "T1AC714DEC7D98A4C2DA139DB7C271FC7E41717265A9C598A4718EFFE5032D23A8A00545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372087, "uuid": "2d31c661-7eb9-43be-bda8-9dbc9b6b8bab", "value": "48:goSo5Q6u/BljgXHlZQcrvDRTQI/SQHo8ceWPspMfqqBz4DzPfijh9TdGED5+HJey:gLoQV/BqXF17Ddj9qbJGrHrgHBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372087, "uuid": "337e24c7-1b3f-40d2-843a-c7d1482543f2", "value": 3726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372087, "uuid": "a9895eab-cf3d-45ee-b5db-5752ead2a329", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372087, "uuid": "cf849e53-47ec-4b78-a66d-70acda924080", "value": "PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27653992-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627401796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401796, "uuid": "805159ab-164b-46a4-82b2-f862532a98f0", "comment": "Malware payload (Formbook)", "value": "f02f2961032796a25c7e090bb4f70566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401796, "uuid": "8ef35508-95ed-4e04-8a77-85961808da39", "comment": "Malware payload (Formbook)", "value": "7a34064785bd677a927fa90988d9001aed285762f230d0fe08db7b2ca89ce987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401796, "uuid": "9c56e745-3407-4591-8ed5-6df970582dae", "comment": "Malware payload (Formbook)", "value": "8c530a1533800db7d8dea165ea93421e2c996dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401796, "uuid": "328ec9c2-e035-4c05-869d-cdf95304a4bf", "comment": "Malware payload (Formbook)", "value": "e8baa0259931e03016b8be7c68613af3db781f3d102f042955e9c0a250e4d6701005aa179d4cf8f51e1eb7ce62b42ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401796, "uuid": "0387f11c-7c34-4800-aed2-cc3507da2b45", "value": "T12044021493D6CA77E0D144F492BA86FB2ABA7670039F04F707826856F5A1BC2983974F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401796, "uuid": "748e0843-5d26-4ec7-8db7-034a5ce0555c", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401796, "uuid": "57d6fe23-e8f7-4e14-9297-8a07ebb4fbb1", "value": "6144:Ld53TvpHeIl0l7o0YJvxPfqAg2bwejuDjwZbC9sU7ltYp9f7OANxB:Ld53TvpHeIl0l7ohBv0fAbCHTyqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401796, "uuid": "09b10c77-be4e-4ef6-8339-1c1cf3618fab", "value": 258369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401796, "uuid": "d7830427-c601-47c4-a5f5-b0f605610811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401796, "uuid": "4f218c91-a394-4ca7-b303-5a8a84a41f2e", "value": "Order-CNS Amura Precision Co., Ltd 9A210118KR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b46bcb0-eed7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627389535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389535, "uuid": "65ca26c5-e1c9-4224-b3fd-50153f38be5a", "comment": "Malware payload (AgentTesla)", "value": "0ed458621a0e75e9dac09b9cf00b909d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389535, "uuid": "6b77de5a-c866-44ff-b3bd-1687003bda26", "comment": "Malware payload (AgentTesla)", "value": "7a6f8590d4be989faccb34cd393e713fd80fa17e92d7613f33061d647d0e6d12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389535, "uuid": "1982d922-0885-4f4b-aed3-11cbcf884721", "comment": "Malware payload (AgentTesla)", "value": "02f07b3badc63785cd66b181657322f851d3b0c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389535, "uuid": "23661653-6458-444f-aba8-c84158a8714e", "comment": "Malware payload (AgentTesla)", "value": "48703dfc8194bd71532b7225816b23e80193e33d02496518d69010b89f030cc519ee977ace0579c358bc005763a2e322", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389535, "uuid": "8d68c0e7-1849-4c11-97b5-e6dbd4874e44", "value": "T199E4AE57F7D7FAB0E6BE827A82B1851C537674920260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389535, "uuid": "02a85e6d-a0e3-4bab-99c8-9f39d4a54352", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389535, "uuid": "3ce679f4-e100-474a-8ec0-4a67618b4d78", "value": "12288:pn/zDvGHAykHSzLW/4+8bzbBSreMdbhgFK/UqWgmrMqir:NzbGHAzHAjX1CcLgYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627389535, "uuid": "583f7f5c-da61-4bc5-b355-2e8e050eb0ce", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627389535, "uuid": "1ee7bd4e-7bcb-4d73-80d9-ea0e23974fff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389535, "uuid": "687b8458-ccf2-4c78-89cd-5de720978a7a", "value": "SecuriteInfo.com.BackDoor.SpyBotNET.25.6539.4149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa205666-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1627384835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384835, "uuid": "e8729ac0-e80b-4c93-8853-487d81c079d3", "comment": "Malware payload (RemcosRAT)", "value": "9d31a177667c2f861a1fe9c6eaecc148", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384835, "uuid": "81525f4e-b4eb-4ea4-8297-d89f6957e0ae", "comment": "Malware payload (RemcosRAT)", "value": "7a87f06752b982acba43a8e736c2a123148963197554714023085bbf9540666a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384835, "uuid": "44876eca-14f2-46ad-9328-fd9aa4ce2ca1", "comment": "Malware payload (RemcosRAT)", "value": "4f18e91d98ba4f2273173757fcbf53dc8e8a3efa", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384835, "uuid": "0e08758e-dea1-4a08-b683-231659593159", "comment": "Malware payload (RemcosRAT)", "value": "536cf32fc8faf3827f6ea2acc7a8758d09726c547e472aea84fec4ca101d1474312fe6339feb957aad471ee70dfabca2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384835, "uuid": "65c7d79a-c83e-49ae-9105-d576e9e25523", "value": "T1E1C423D6C364FBBE2B369190EA868C4C04A9D59DFC39D2457B3E7265D38F74C208A139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384835, "uuid": "765d125e-01ba-4195-989e-70784b2847c5", "value": "12288:qi0Ni/I/Mg8lJaGjyub130YdIJTX7TWAbS2o7juHgayopQ:XESI/21pb1EII1TWAG2o7jsgTo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384835, "uuid": "c00efa3a-2e3a-4c99-a44c-d3be9b8c68c8", "value": 556115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384835, "uuid": "a06aace2-1434-42f7-af6a-e5a7c775a98a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384835, "uuid": "49bf1338-8941-4682-94e7-7c45dc42a8b8", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3538c57-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627402111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402111, "uuid": "5fd23985-e4bc-44d0-9ec9-f53d49928c4f", "comment": "Malware payload (Formbook)", "value": "77e9f5464c103f8fedf6ae500d87dd32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402111, "uuid": "fe8b6af2-2746-4f5e-8c3d-987483b1882f", "comment": "Malware payload (Formbook)", "value": "7b40c9c16df4b35ae04076a8afd38c4fe4bf5525bb388ea3871ec2371fa9e049", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402111, "uuid": "62370532-3d64-4c92-ab3a-676afaa1e737", "comment": "Malware payload (Formbook)", "value": "63ac44a904971f265decc404583bd3912c31cf02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402111, "uuid": "6cf8c34a-5077-4c50-8c47-2ecba1d4fb69", "comment": "Malware payload (Formbook)", "value": "cb1bed309aa1a000f8f427bef83acf41637254e40f0b6c1bf19dbaaefb01907044a4d3da0e40b029e5f464255cad4e33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402111, "uuid": "62d14400-8226-423d-bba9-dafb401fd5c7", "value": "T13CE4BEFD353A774FF44384BE50B44CA2695050FACA6EC792F72342AAEF1D49B99002D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402111, "uuid": "ee32ef6d-f290-4e4f-a9e0-c05faef3f498", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402111, "uuid": "bd60477d-e43a-437d-93c1-6abce8ea2c96", "value": "12288:ipYH4NalijuwznKrVxEv4+IU6fayumYP9seHEdxAdAQUwFim4O9qAov0d/+y7mo/:aJ6jwW+IpiyuIekdKBFFim4Ol7mo5oFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402111, "uuid": "24edf05e-57f2-4ff0-83cf-706062cce6b4", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402111, "uuid": "ec40a1ff-cd6a-43bb-94c3-e6fe7b6b1a44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402111, "uuid": "5d6d9e43-7caa-4ba5-889c-60eac9b746df", "value": "77e9f5464c103f8fedf6ae500d87dd32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d317f6-ef01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627407516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627407516, "uuid": "0f040261-2171-494e-a956-7a8dba1e92f7", "comment": "Malware payload", "value": "7aae45c28c0ba617a334104cd6e705db", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627407516, "uuid": "02e8eb55-54be-4a66-8f67-ab7518b88ec3", "comment": "Malware payload", "value": "7c958f1fba773338640a76114bec6d411d0e765209f87960580d4f0935cc58c2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627407516, "uuid": "53b2dded-ba48-4e21-bfc0-f84322b658ae", "comment": "Malware payload", "value": "6e24780fa1e32d658011c84bff63b1e6c1d1df64", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627407516, "uuid": "14710f07-9022-476e-b60c-7cf3e145d53b", "comment": "Malware payload", "value": "865c483bb399d7651a8a52079f01502c6642340f0d659d5a5ba267fc7cb0abfba85d084860ff617db6222f3d292229db", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627407516, "uuid": "2a96c164-99e7-4008-934f-1ddd1394fc4c", "value": "T1261633EBD1909C8DC91F4936F483AA5B783911188B85B07F027460D85DE3EBC1D6BEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627407516, "uuid": "80f93e7e-295f-471f-94f5-cbb75d5fca55", "value": "98304:4ketWjenRmsUaPUumBwrr2UavlwI5KbQTdE7KXv8jcwMqZe5UHJMsKnu:9jenRjPUumB0rg9jEWhf0FmuGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627407516, "uuid": "98d1d737-12f1-479d-9667-a72874b171dc", "value": 4049995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627407516, "uuid": "20819728-b940-40a1-9c3a-8f0edc895349", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627407516, "uuid": "b73fed48-38b6-4019-a9b4-45c203f44af3", "value": "Android-Update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaae7659-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627396970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396970, "uuid": "5ddb0046-ae63-42cb-843a-598a9eead9c5", "comment": "Malware payload (Formbook)", "value": "7c5f2178cbddc544639af018ee27181b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396970, "uuid": "f8e1727b-f4fd-40c0-8853-b618057e62b2", "comment": "Malware payload (Formbook)", "value": "7cb3ffa44654db626e5eaec3cf679ac8c4c033db7103fff7da4e8ccb4aacf797", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396970, "uuid": "d2dbf4e6-6ea3-4c78-9bbf-7c3166626d11", "comment": "Malware payload (Formbook)", "value": "b587c5fe244c025ea92e8ec1e112da5a1d151084", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396970, "uuid": "318fd968-0691-41d9-a59b-64d7b665f1af", "comment": "Malware payload (Formbook)", "value": "e6427cdc9199a87f243551063175d0cdacf5d63f17115b366f7e2eddba1f7ba9da53d22278f0fe15a510b256e3f1ad24", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396970, "uuid": "73f128fc-da24-415a-bdc9-7ae9ff398618", "value": "T13555121418A5979DD439E7FDC0016BB8864D3E0F75A2C883A56877583EBC732A8FCA47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396970, "uuid": "12b3a890-8448-4e43-bdee-3b7b16aa67b4", "value": "24576:SAkVLSaEWyumNfmI3CcWWsK5GPxvQDBajlMOrnVBhKR:SjOFnumNexcW8UJYqMOrFKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396970, "uuid": "08aa0352-adc6-41c7-a0e5-4daab5ecbc73", "value": 1290752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396970, "uuid": "13094ab3-e24b-42ff-aa75-e4a34108bfdd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396970, "uuid": "35b4b803-93b4-4929-afce-e4b3491d2a1e", "value": "HANYUAN PROJECT SDN BHD _PRJ S2505.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c19bf74-eef5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402368, "uuid": "397ac5c7-085c-4493-9deb-1532327fe2b9", "comment": "Malware payload", "value": "56784137661c7e02c6c0e36b8fd217de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402368, "uuid": "b6cbab07-bbc0-4517-b8f1-36d3a3337398", "comment": "Malware payload", "value": "7d65154a5dc05da45ebfe7b8a5bdb4858bf80812060257a5bde5d90ab12b23a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402368, "uuid": "1a3be6bc-30e8-4c54-9885-86cc42aa9706", "comment": "Malware payload", "value": "5b5d6c51607a99af40889379e369f8ecb98f95b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402368, "uuid": "f8fee7cf-06d5-43d6-8915-aa018b875d3d", "comment": "Malware payload", "value": "1028b8cd0c18c3bbf9bc6c8b1722079764527156256485230d03ba769bd8d9b836188a2c69bed8a5c651c91697bb71fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402368, "uuid": "a9897bd7-2f79-4d96-bd22-82004beacfb4", "value": "T1E6E4BEF935393B5FF493847E54B05CA2696050FACA2EC792F33342AAEF0D4979940297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402368, "uuid": "c802579b-1f75-4899-9c45-9df49d15d93d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402368, "uuid": "9322bb81-ef9a-42cd-b34a-1d098174f68b", "value": "12288:noB6Z+vj1V/TGhkos592LLwHXv+qASDIZAkHD1/m1XVm5bfISx7mo5oFCEkv:noB6Ev/Ghkos592LLXqAO2AkHd7mo5oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402368, "uuid": "7516d4e9-684c-47a5-bbea-7e9ebb2a65a6", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402368, "uuid": "3bbd9aeb-2d6f-40f3-9da5-c34e637105b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402368, "uuid": "ec95288d-80c0-47ba-bdba-46b5c81a2505", "value": "56784137661c7e02c6c0e36b8fd217de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437e495a-eec4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1627381227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627381227, "uuid": "69eeb225-8709-47b8-9cfb-83a4bae0ec81", "comment": "Malware payload (Gozi)", "value": "f5a6826935129b01ed9a44cab462c913", "object_relation": "md5", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627381227, "uuid": "62b1b73d-75e0-40e5-a7de-064f3c529c30", "comment": "Malware payload (Gozi)", "value": "7f24c4eab4284bdd0160edd3d9d1f024c0470bd578e3ca3d24e024638ac190bc", "object_relation": "sha256", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627381227, "uuid": "677fbea9-c573-4d96-97db-3c877369137a", "comment": "Malware payload (Gozi)", "value": "de54adb2467f6477a4075058c46a72875922cc4a", "object_relation": "sha1", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627381227, "uuid": "991b1b1c-bb74-44c6-a26c-d2349dcfa038", "comment": "Malware payload (Gozi)", "value": "9d961d8811f38e970b29ea4fd59bac19d51c93739ed415ab7d62e16a033de462fdd56f03a964cb8e3cdd608e63b88b64", "object_relation": "sha3-384", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627381227, "uuid": "89df9052-51f9-4256-a452-a8f39ddcd694", "value": "T110336CD82AD1DC4BA38D1E23EF867AF5D67AA8D694C47507D2487E4C64F8207C9E1CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627381227, "uuid": "70558f2f-29c7-45e6-a5f5-8bd43016c1c4", "value": "1536:2Dt6RRClAP16BAjTDt3Jz2Fa5Tv74iRrNmIgcLhxuH9Nm9ItmvDfgGgU:2URRClK3HJ3JaFa5Tv74iRrNmIgcLhxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627381227, "uuid": "a13571d5-73f6-4edd-85b4-a625d46580b9", "value": 54470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627381227, "uuid": "729fe63d-c524-497c-8ed4-59fe225f3cfb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627381227, "uuid": "7c1b4d58-a819-468e-8187-c2f9889a26a0", "value": "form_documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6c8e73-eef2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627400974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400974, "uuid": "1a9dbac6-2eb9-47dd-8425-62d2f81cf285", "comment": "Malware payload (AgentTesla)", "value": "9ce7495a840078892fb01cdcd7001b63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400974, "uuid": "e66b3be6-baf6-4487-bd45-8185327e31b5", "comment": "Malware payload (AgentTesla)", "value": "7f37a6ecd3a5350ee65960da3f0e73780834539302dbc754ab8080df38778379", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400974, "uuid": "85492f75-68c2-4bbc-a33c-625006ea257d", "comment": "Malware payload (AgentTesla)", "value": "b9cf3f26a8f077bca7513800b731e5b5d2ee8824", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400974, "uuid": "dcc5d8c6-45c1-4afb-a5b8-e2df62d7861b", "comment": "Malware payload (AgentTesla)", "value": "e03f358f66a0291d1b7468e66314c6dd4ed590ae7dc6f332dfd9ab871d53e0fe89c0576283ce8a0c78d82026c751b36f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400974, "uuid": "e48d2b41-4bc1-4bf4-86d2-4fe668f39fa9", "value": "T1A4F4262861955A5BC13296B3C5A4E332FEF01C967203DD0A0AD7FDA73E72603698DE0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400974, "uuid": "a884c1c5-2982-46b5-b054-bc585ca05b8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400974, "uuid": "bac3da98-f2d6-4516-8949-3059aa8d1f9b", "value": "12288:ygZAq4jiP1/2Y4yyGkS13C9y+JzAy+9MA4iS:ygZAq4yyGkS1UJ+y+eXiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400974, "uuid": "dac52736-fe3d-49b8-86e8-c9be8746ffd7", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400974, "uuid": "29ccd1ba-cb29-40c6-ad82-623a173d6961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400974, "uuid": "d951e540-d4c7-42cc-9c8f-fe3ac16e3aef", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48200cec-ee82-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627352888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352888, "uuid": "47cb0170-aa35-4d66-a79e-d54c316da11c", "comment": "Malware payload", "value": "34ea0f0a18a79eaf559fc23a45de2599", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352888, "uuid": "7d72de24-b4ba-47a7-9f44-83d73aefea03", "comment": "Malware payload", "value": "7f5d6dba1b03e6ea53aa5bdb0f3f53515d6b82fbc4a6f4f072e047c420e53154", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352888, "uuid": "c93e026a-af2c-44a4-9de8-3d1c1fa80e34", "comment": "Malware payload", "value": "815d0e33f609b9e0a02c733962e34c03dcff8b69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352888, "uuid": "aae0f90a-95c9-4480-beb5-18403c289ea4", "comment": "Malware payload", "value": "07c30c05c2e6ca822f3653502480fa43d763421f9eadf80db8c00e63911a67bf9517115d8841bb8f238f9d3577e09564", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352888, "uuid": "045fa8c5-9175-4cb5-90b0-8d7f5b0206b3", "value": "T123D633C58E91C131F8470ABA0167AEFF46EF8C90D47C5D17AB6E7AC419F9080E611ABD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352888, "uuid": "27bdd60d-0a78-45f2-8f99-9665433ef3e3", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352888, "uuid": "f8142601-0f88-4656-9ff6-a108d8329c32", "value": "393216:pnJ4Brh4aPNenhMldehDxXM6i9bhznJTZxxpi5cJzTt:pJGJMnhM2JM66dJbxVNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352888, "uuid": "07718ee1-3201-4ae4-a8f8-0689ccd0937f", "value": 13099238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352888, "uuid": "5a5a4a61-376b-43b0-9d41-959e49335433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352888, "uuid": "a8c30e0b-0740-41e2-b064-4b87b7008465", "value": "34ea0f0a18a79eaf559fc23a45de2599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fea6708-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627365249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365249, "uuid": "8fa30f52-a1fb-4b8c-8ce3-e51b89542ca4", "comment": "Malware payload (Formbook)", "value": "b065fd2f4a275b4b09e831261cb118ba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365249, "uuid": "ad7c8d4c-d987-4c10-992d-2a4716113842", "comment": "Malware payload (Formbook)", "value": "7f6c173fe8dfdbe249e43ff5855d82f9ae9c86a1d47a6515eae08f3c5afadc78", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365249, "uuid": "bb4639c0-fe04-4198-9860-5cf1622e8650", "comment": "Malware payload (Formbook)", "value": "fa6aa739bd9a427f2b465ae3c37ba2c5c81a89bb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365249, "uuid": "4a7abdaf-337c-4cad-812d-70c6a47a233f", "comment": "Malware payload (Formbook)", "value": "afb7b3d280bc47131585b7d85d0a4d13c6227c8334cfb8702deac37967758867dd95b021db13be07c934b9f7a656aad8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365249, "uuid": "f934604f-cd1a-4dd5-b77a-4ceb0ba0b0b3", "value": "T1ABA423C2058F7A232582C2508BB5E2933549F9CEF5E0BBA07BC771889169B57C5B27F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365249, "uuid": "e04621ac-dcc7-482c-9444-5903b4f1ae9f", "value": "12288:VbgQ+Z8sULFcz3bqfINgTfE6aD7VWumhw471M4g:VboZkcz32fINgTf05WLw477g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365249, "uuid": "bca81380-b5e3-4c6d-9cad-31493cc36b4d", "value": 476956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365249, "uuid": "c790ac5d-a86b-4961-bae4-a159d1912d77", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365249, "uuid": "c1525604-019b-41be-803d-bc3a783c7252", "value": "Instruction copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52730c5f-ee7a-11eb-875b-42010a9c0053", "comment": "Malware payload (BillGates)", "timestamp": 1627349470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349470, "uuid": "3760ffed-208d-4ab2-a4a3-09800b802592", "comment": "Malware payload (BillGates)", "value": "7f0c9c24f2bd4145e923fe65bcdfd49c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349470, "uuid": "2506b90f-80af-4f53-a773-6c2131a87ccc", "comment": "Malware payload (BillGates)", "value": "7fd819ff6a69b045b0d7eb9900987dff73792a68acaa45cb0e2ef9298c5bba54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349470, "uuid": "435dd0eb-781c-4dc6-85b0-a0b9d67c1019", "comment": "Malware payload (BillGates)", "value": "ee482d0f762f102a86bd500c16b2586d3d20795c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349470, "uuid": "9f5a16e8-ad61-4a8e-94e1-eab12c198579", "comment": "Malware payload (BillGates)", "value": "96f4aa8ce54d63c31d5979dd7f7eba5831863bf68dd64047f96beff15e6cd9ba5d8f52069ae6b136de77567b568a69b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349470, "uuid": "4998133e-f2a5-4058-a199-8418dc4d4473", "value": "T1D6456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349470, "uuid": "a4e43ea5-0623-4193-8f3e-e1ee7e9c079f", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX462y1q2rJp0:745vRVJKGtSA0VWeo5u9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627349470, "uuid": "23b8458d-d5a6-4865-a792-b2ce8e72482a", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627349470, "uuid": "f0587c20-b776-44b8-a254-987816f45201", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349470, "uuid": "49e81441-478c-4cfe-b83b-17d94f8679e0", "value": "7f0c9c24f2bd4145e923fe65bcdfd49c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735b1d85-ee73-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627346518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346518, "uuid": "ef872589-ef0d-47f3-bccf-fc141933c341", "comment": "Malware payload (Mirai)", "value": "e2d111f42693cd8931ec5101a4c63160", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346518, "uuid": "aaaabf4f-aad9-4d47-bff8-2208c1cd96d8", "comment": "Malware payload (Mirai)", "value": "804180d49a6f31dfc88b052fed6112082b0ce08ef3be18ee88a095791d58d894", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346518, "uuid": "28ccd0e3-a536-4b20-99df-f8939fdaa51e", "comment": "Malware payload (Mirai)", "value": "27b620c13828beb718246ce81589a032dbf75352", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627346518, "uuid": "f65d5bdc-012b-4e7b-8595-4c6f0b6d4e06", "comment": "Malware payload (Mirai)", "value": "3de7eb6ab7fe77acb5898edc58995f4a64f4b6f6988cce1201f630d20d48672e6fbe20eb5d30e8c41b0f9afece45ecdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627346518, "uuid": "f80c5c5c-d354-4f4c-ae0a-d8d6fe9deccd", "value": "T1FBF20741F98B80F5ED0B0A309067F63FDB31E92A0075D66EDF59AE34CAB7681521728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627346518, "uuid": "5432697f-c1f3-453a-8ba3-b11f8e787ec5", "value": "768:JMEgnSWmBscE3Dd/4dkyqLAjFiOisr7df2q1710moeCE:qEoMsx5AdZMAjFiAFf2a1Jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627346518, "uuid": "70d18fe2-e6d3-4a46-ad4a-4bc3bec20ef4", "value": 37508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627346518, "uuid": "78536bba-a45d-4769-975e-fe9915b5c94e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627346518, "uuid": "de5fa544-0097-4f90-9f54-057de4a37c30", "value": "e2d111f42693cd8931ec5101a4c63160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65561e0b-ef27-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627423804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423804, "uuid": "d319e488-a0b2-42b5-bc55-9bcba8e5e218", "comment": "Malware payload", "value": "048271f7f2f8d900485dd020cdea2dd9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423804, "uuid": "f09621d0-dc55-4c74-b9c5-31dc2e661302", "comment": "Malware payload", "value": "80deed939a520696968335d1bb2a9fcce7053c0156f679ba261824d0a2d44967", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423804, "uuid": "f2dc1724-6483-4ffe-88c9-a606d7c98462", "comment": "Malware payload", "value": "fc48ae44addc9e1d00238f5ba798f3876e69c561", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423804, "uuid": "e609749e-72b0-4a90-abed-34a06604000e", "comment": "Malware payload", "value": "5ad8c25e004a0d9dc066d1056cb08f8829a903ff95112fb8d54e07569a92944d4941b4bd573a2ac35d6f0b58cfed0bf0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423804, "uuid": "cb3e5428-29cd-4219-9b82-b06a588a4c6c", "value": "T130948B036ADCBCE2C079137573BB87D0C72EED6599E1C40E6AD00289D9BD1937A227E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423804, "uuid": "fb595d04-399b-4868-9dce-6df1b8dd0baf", "value": "d71092979deae75937e8d206e56f88fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423804, "uuid": "1198dbf5-ff54-45c8-b1ee-8fd2436c74c2", "value": "6144:5bLl5/Muaf6XK5dTTX1eokmAFM88KR/DhYvnz4b7D4k:5jkfGK5dTTleAmtBBDcnz2/4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627423804, "uuid": "175a0782-bbfb-48d2-9fe4-e314bdf9a461", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627423804, "uuid": "8aae08a4-bfbd-4db3-a7b0-bad493d281d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423804, "uuid": "a6fc5820-078f-4b65-83ef-d0b555233fd7", "value": "80deed939a520696968335d1bb2a9fcce7053c0156f679ba261824d0a2d44967.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e634f79-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1627366240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366240, "uuid": "9f981e83-8e13-40cc-9648-8c4428f22bd8", "comment": "Malware payload (AveMariaRAT)", "value": "6cad89962d1effb877d9b69a0cd64526", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366240, "uuid": "65c04b31-6ad9-4222-ab96-395cdd9eac49", "comment": "Malware payload (AveMariaRAT)", "value": "8245da6ea7589c11b38f1204ebda458b95141db0a5048a8ce0a4b93a562284e8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366240, "uuid": "7e8500dc-5706-4535-8f76-6a21cbcd930d", "comment": "Malware payload (AveMariaRAT)", "value": "3fa3ce0c892a4881b49babbdb1b8bed43c4076e7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366240, "uuid": "13b8364d-c2ea-4994-832b-6e78e7d1d769", "comment": "Malware payload (AveMariaRAT)", "value": "b4c841a03e66eb57f089fcac0271fc78e92f93193cdf3c4e61d5ba912256fd9096ae9d040d38f21963d388accff3624a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366240, "uuid": "58c3f39c-54b5-467b-8e8b-6e01e6b60082", "value": "T13F15B0F039183B4BF05F4ABD606D406297E0646AE215DFCEFBE16C6ADE1A2F109491CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366240, "uuid": "923057c9-882d-4aa6-97ec-b9cc8e716ebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366240, "uuid": "90e3816d-a9a7-4358-ae85-b2239efc7a85", "value": "24576:s0R3iOsBgo0q4wMsBNJIjvGm2zMY/jgfGw:s0RzoHMGDIjvR2zMY7gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366240, "uuid": "ea5ac2de-723c-403b-b84e-a616a10af9dd", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366240, "uuid": "82c7a4a2-4a0d-4151-a228-efcd9bb2111a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366240, "uuid": "c50614cd-c2ed-442a-8d0e-396cab161c29", "value": "TOA Vietnam Co., Ltd - Inquiry Note from 27.07.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f70c88-eeb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627373011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373011, "uuid": "1b66fc0c-2ffb-4dbb-9ffe-0b5b120f0838", "comment": "Malware payload (Dridex)", "value": "71571c1702739aa58db4c5ac426c9817", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373011, "uuid": "2cfd64aa-8d95-4291-a798-befc6149d381", "comment": "Malware payload (Dridex)", "value": "828d60f696d4ee8c80b6a17a3b2462a744d87297b8016488ef67dc20ca86a5be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373011, "uuid": "5a2f5362-6a3c-4a3f-8ce1-1421ffcf3049", "comment": "Malware payload (Dridex)", "value": "24b25a50153f98d95c81e6a49648b778891caf35", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373011, "uuid": "0a7137dd-ed95-400d-8856-9358767afe46", "comment": "Malware payload (Dridex)", "value": "40ef870f61dde0b4bcbcd032235c02d74189af345e99091f548606086eabfffd25a0da8c757e9037b2ad00854b7d49ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373011, "uuid": "c99f246a-30e7-4bfd-94cc-6e0e472a7a03", "value": "T1C304D161DBE759C5D7A3C57ACC8CA17BD1293C0B8A6CD27C6208D2CC897AF0CC5A4D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373011, "uuid": "ef9a973c-05b4-445b-8a68-b83d031b8b6a", "value": "89aebe8644a760ddbd7c2e801228e7e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373011, "uuid": "8e542061-7de0-4a11-9ce3-37a3b2e1c027", "value": "3072:MrHNLuxQI4JTJlYDFS6t2NAgEaakq7MCi6TM7EKNfFln:MrH5PB3ot2ygEasni6TM7EKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627373011, "uuid": "042396ca-fd7f-407f-ba77-47778a48c98b", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627373011, "uuid": "82b1a52b-525c-4cab-b8c9-45a02f300b6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373011, "uuid": "63d88891-5df9-4773-bace-66e549ece232", "value": "qCurrencyTrailingZeros.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d46a65-ef1b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627418884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627418884, "uuid": "8ce6ef3a-6006-40db-93e4-da9a8c8c8e9d", "comment": "Malware payload", "value": "3f40014dd3cf212056d3ea4e81f253de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627418884, "uuid": "85ba8fa2-904f-48b0-87d0-f13ecf7e7746", "comment": "Malware payload", "value": "84d7d4e486208acf48a9b5108034c325d3420fcd3256e0611e87fa2dda52a910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627418884, "uuid": "55726033-abac-4ad1-8836-1de09cedeef6", "comment": "Malware payload", "value": "27be3424c54288a9ac070063f130e7e7c4c8b255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627418884, "uuid": "f0a58a27-672b-449f-b24b-aa918a3ee4d7", "comment": "Malware payload", "value": "217d96fbc6b67a2efa464f8ec0b3ca24755f3d7507bdb03982f7a444a4ee3f5c9a9dbdf27aa185a81b273515b1314101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627418884, "uuid": "ca44c6e9-5e72-4743-88f0-67acd6852f2f", "value": "T10D15F1263227A214DC3887F51C25D1B12BFEAC2A566CC37C2DC8ADBF7D726B85AD0540", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627418884, "uuid": "a2a1a431-8109-43e4-9c8e-7a18b35cbf3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627418884, "uuid": "b5a93f34-8edc-4fc2-9021-5369dcdfbda4", "value": "24576:I1vDBlBPIOBPj2xznLZ2UgW5dseY+i0QwAzA/Qf:IxpPDPjmL8U7ds2i0QbTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627418884, "uuid": "d475f944-e051-4f80-852a-6e2d5e081393", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627418884, "uuid": "23e98be9-76f7-4e3a-ac97-05194cf05eb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627418884, "uuid": "571106b7-94c0-41dc-8d6f-9d0a5f62695a", "value": "Cargo details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03817444-eeb8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627375966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375966, "uuid": "8909c555-e9d3-4592-bcf1-c8ad2e81746a", "comment": "Malware payload (AgentTesla)", "value": "52316fda37685484f30a9e9ab4aa7dae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375966, "uuid": "929927ab-d73e-4fc2-96c9-50ced6ed6df3", "comment": "Malware payload (AgentTesla)", "value": "8586940b285a92802ff9ca77ab7fb949de2a24784d4724dc18ce6d9c1ad6f187", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375966, "uuid": "d13d142d-33a2-4475-9f8a-091fb4f38267", "comment": "Malware payload (AgentTesla)", "value": "c0677360ea2701266a5fb1a43cd763a7dc18beeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375966, "uuid": "3eae523d-7641-4100-bf3b-5886d394aaec", "comment": "Malware payload (AgentTesla)", "value": "7c1e8d88f27e936381eeb952fda6b34a9d03ff9574e70339aef2d68a03f1aba9c1b43249eef3a6d85d04f4d755ea48f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375966, "uuid": "f46e8bd9-62cb-4770-ad80-b2e5f3330901", "value": "T10AF4CFE4063D7F0FF0AF4B7E907140229BF0609BD969CBE4FF7205E6AF552A61016686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375966, "uuid": "4fbfd4ac-cd10-4567-9b25-21540b9c2594", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375966, "uuid": "f4cee984-2f23-4b77-834e-c9aeeb0c9402", "value": "12288:TyiPU9LPU9aV0LBlNRXuOsBgo0q4wMC6aNTNcE5alPu9zUsFX5MftHDtC3+mOAB/:Ty4RXuOsBgo0q4wMCfms15AoufG6OkF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375966, "uuid": "460593bf-e55d-4f8f-91f6-a345f450b4f3", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375966, "uuid": "8aacbd49-2b33-4c61-8d36-eeb000a52774", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375966, "uuid": "a9aec498-e44f-43d7-b7f0-c93b35ed2918", "value": "52316fda37685484f30a9e9ab4aa7dae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce23d968-eea8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627369434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627369434, "uuid": "4e34c18b-b230-4f3b-b83a-d60c5af558c4", "comment": "Malware payload (SnakeKeylogger)", "value": "51b772a457b8697400bb70e6cca34ffb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627369434, "uuid": "9db9d4e0-e260-42ee-bcda-8fd22888f0a1", "comment": "Malware payload (SnakeKeylogger)", "value": "85ee1ec9ae72c6faa52834220e9755407dbb2c49c4371ed3df36d093137cb9ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627369434, "uuid": "930b2a2c-9fef-4782-8e5c-e41eb254f196", "comment": "Malware payload (SnakeKeylogger)", "value": "5bbb0142bf76aa9559b52591a52785ba85a7ec69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627369434, "uuid": "5e50c45c-1c05-4328-b3a7-fbb2b68cb14d", "comment": "Malware payload (SnakeKeylogger)", "value": "ae7493bf8bed2fd72364503d05a02d946f434bf3e08725811a21dfe07003e2580a9e7c6d92b472e1c73cf04141d4f335", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627369434, "uuid": "cf098e1c-d107-48ca-9671-10f8d84e88fb", "value": "T1C2F4CFF8353A7B5FF493847E54745CA2695020FAC92EC792F33341AAEF1C89B9940693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627369434, "uuid": "b56fcd74-5784-4c98-8087-83b896cdf4a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627369434, "uuid": "bf2ff950-009a-4d22-9dab-bac15990f797", "value": "12288:lL3DerLdE/RS2AAzibSb0veEwx4QaH10DXraaFhOfKY9si+0WXOYVR9hSBW633cQ:h3DmLeRP47wx4QvHaLsP0W+l7mo5oFCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627369434, "uuid": "80584cd6-1018-4d31-98e0-62fdc93365e5", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627369434, "uuid": "66ad30f0-7bfe-4b97-90ff-9cf1f407c141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627369434, "uuid": "b50e0937-3d56-4775-a91e-fc5b547130b3", "value": "51b772a457b8697400bb70e6cca34ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85b76d3-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1627375947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375947, "uuid": "ff18279f-86c1-457d-ba56-f94373889412", "comment": "Malware payload (NanoCore)", "value": "2d5e1b62b58404ac5040f7454b9a73fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375947, "uuid": "84efdac7-6e94-4ee2-b047-630f474517ca", "comment": "Malware payload (NanoCore)", "value": "871e94eda4712d5e5549cdb71e84f794baa7fe2b52ba191ecbbcd576549fd94d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375947, "uuid": "e57ec4bb-322b-439d-a4cb-38174d05601c", "comment": "Malware payload (NanoCore)", "value": "9b90698444e1abd3cfc04959ebaf8ec7c0b5bcec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375947, "uuid": "71f6b040-261a-42e2-8669-842fecf5546c", "comment": "Malware payload (NanoCore)", "value": "0ff78582005f15e691d7d941bbd903e76c1275af525150b463d4b3d50defdd1551be5b8b7c2bdcffdd91f59f9e190bd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375947, "uuid": "6fa23812-631e-4928-a9ca-37e242d0c5ec", "value": "T1D5D412B23B21D5A0E2B50F71B34BFB408FB4BF8761468665B04C13E1A2B671A1F0B759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375947, "uuid": "d7ea3097-e3f8-4ed1-a37a-f4faad76a487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375947, "uuid": "82c5abf5-2c52-4ed7-b52d-a27ae1074749", "value": "12288:9V1gsD1nB3pSp0Yxd64DOKLLX6liI+aKCDd8bognRUSaHNKnj3O:9VKsV/Sp0q62BL+caTDcot1kj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375947, "uuid": "7cb589b6-0b3a-449c-842b-95c155a1ae79", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375947, "uuid": "c0ff9c18-2654-41fa-ac21-0eea4990bc8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375947, "uuid": "4120e0e6-0f70-4576-8991-ea011d678882", "value": "2d5e1b62b58404ac5040f7454b9a73fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8290b6e9-eeb3-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627374032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374032, "uuid": "33eb32f6-7e4d-4289-b486-6bd8fbcfd406", "comment": "Malware payload (Loki)", "value": "012678f684c305c94134a4c816fff242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374032, "uuid": "0adf0cf5-2492-484c-a8a9-10672bb482d0", "comment": "Malware payload (Loki)", "value": "875ab4a8c0e8976f706fe0417ccfdf4d78bab6c845f4b3bb5a9e79414cf34c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374032, "uuid": "51aa7222-4df4-49b2-a4bd-e2bc74022cd5", "comment": "Malware payload (Loki)", "value": "493521556f140df3b2670b8b28816a24a4676bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374032, "uuid": "dafa4245-38a6-42d2-91df-07fa798bab18", "comment": "Malware payload (Loki)", "value": "e3807b7f6bb97223edd20886ee522217dab85c310076d7bc5ebe80157db4e463edcf310024aa3e0d99b9c49825e73e77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374032, "uuid": "03c64bb4-d29a-4e80-8587-d22ada81b458", "value": "T126C48CE835A937DFF04344BE5C707CA2295014FAC92ACF52FB2311AAEF1C497956069E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374032, "uuid": "71a23f04-7e4b-42f3-ad6c-4c01a662c214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374032, "uuid": "df5fab6b-0cdf-4543-bee3-3a620b848e4e", "value": "12288:y3vTM/yHkUt00h7/aEmiKXOGD88hPxAOLgY7mo5oFCEkv:Ow/M0+uEmj5Is7mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627374032, "uuid": "1499ac65-8086-4842-af0d-571aab5143bb", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627374032, "uuid": "d69b0100-1c59-4056-a272-f59e60ba1e9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374032, "uuid": "1778c7c1-d3b6-42eb-96eb-c4feca9f5d16", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40150905-eeb0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627372632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372632, "uuid": "5e1ad0c7-57a5-4358-ae31-438be12fcc72", "comment": "Malware payload (Dridex)", "value": "725b1026b0aebbd378424aa9cde30b22", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372632, "uuid": "1b79c828-7f3b-4ea5-b6a2-cebaf480e663", "comment": "Malware payload (Dridex)", "value": "876692ae15f9f333ab388773d219f0b6937d2e24fe96bf834dc681de220dfaa9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372632, "uuid": "92f0b8af-19f5-4f37-b7cb-28335f3919ff", "comment": "Malware payload (Dridex)", "value": "b637df8ceab8bca97aee7c40bfe6ce06a3d89c74", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372632, "uuid": "eebbcc0b-9125-42fb-9797-632cc3e22f16", "comment": "Malware payload (Dridex)", "value": "9727697d1cc137e5d9509b491204a16a99e1cc8682c4a78856ed628d52838e4fa279867c89addbdffdaa5b9328cc2212", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372632, "uuid": "4ceeb169-6db5-4482-ac30-aa20c56257fa", "value": "T132740246E47BCDDAFF5B003B28810FDF4A533D168ADC92F8E730765D8826F692966112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372632, "uuid": "92c25f6a-be73-4e29-bf68-a65b580d1466", "value": "6144:2Qj+sWRo6tcJhv7Bzg+8h6F493OzNStilQRl9X+TYry+0FQ:28+Zenzdl8OLzNStpKAyvFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372632, "uuid": "be3426de-fe30-4bfc-93e7-1f5bde30e080", "value": 339192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372632, "uuid": "881898dd-1021-4fc4-b753-db81892c62e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372632, "uuid": "e5c3af1f-d4d4-40fe-adc5-a2fc2ba25f84", "value": "Invoice_158572.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb83557-ef18-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627417352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417352, "uuid": "cf6a34b6-5930-4709-8f6b-191356aed3a7", "comment": "Malware payload", "value": "9ae32ad159d126278d9f7fc94f96adfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417352, "uuid": "6ce8c89b-b81c-456c-a171-e9b29eccd546", "comment": "Malware payload", "value": "87930e435af99eda9ad298493193b5ca78d4c3aeba7747158f2e983e8ee4445f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417352, "uuid": "8d53f871-e1b4-4603-ad40-5a6d8fa347a6", "comment": "Malware payload", "value": "59469daf99f9fbc0b83d9fc1128af4e313f89b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417352, "uuid": "bc20fd4e-fe7f-4d5d-bbdf-607076883b25", "comment": "Malware payload", "value": "48309e7cb9fc4a9cc22e2c8830514a332b72408ca4a3bf165fc26155549f79f6ca78dc53c124a8c483378125fe02763d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417352, "uuid": "6610c7c7-1c03-47c9-9c54-94a3541419b5", "value": "T11BF57C1BF594C175FDB214F4D82D66F6546E6F60CBBA80E39740FEAD38302E2813661A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417352, "uuid": "413a0505-20d5-4cfd-80c4-5434800591b9", "value": "35c2f642097f5b6e1cfa60f847ecb5f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417352, "uuid": "1f12813a-05b8-4b8c-a1f9-467d62531b33", "value": "49152:2jH5mJX9IvGtO0j8DlojeoQcXiG7e26q/+M:2jH5mJywKyZLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627417352, "uuid": "3ac542ec-efac-440e-a086-2e2e3bb4bafb", "value": 3428352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627417352, "uuid": "3be974a7-3650-4991-af9c-8af1846b97ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417352, "uuid": "a45da4a5-cfe9-424f-9396-f10183c6c7f6", "value": "\u201c\u8d4c\u535a\u5c31\u50cf\u6eba\u6c34\uff0c\u8ba9\u4f60\u558a\u4e0d\u51fa\u6551\u547d\u3002\u201d\u4e13\u76ef\u5e74\u8f7b\u5973\u6027\u4e0b\u624b\uff01.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e782bd8e-ef31-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627428318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627428318, "uuid": "19f18b2e-ddb5-44dc-b100-a7e91167c868", "comment": "Malware payload", "value": "f81ad3b7806b6212d99d13043c3c1790", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627428318, "uuid": "adaf5541-682d-4ae2-b3a1-de4f3944ac4f", "comment": "Malware payload", "value": "87adec6a253fec4d2ad78edc4dd7b009de090b551fdd9fc55fa388c0ef3c663c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627428318, "uuid": "91aa87d5-f46a-419e-9b5a-6a733c1a51c2", "comment": "Malware payload", "value": "243268376a164c55b5854e0c831ea0069f006eb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627428318, "uuid": "40f30aeb-e45b-4838-936d-341ddb4e51b0", "comment": "Malware payload", "value": "c2f13db2afdb590bddd2572884db8d2a1c3bd785d18383235cb4346eaacdc0097ca9f3835e6dc418a16f7f8ad12e28a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627428318, "uuid": "b08f88e0-3e37-4179-8577-df7b3240e3e7", "value": "T1FC03F155C02C63B2EE3498F24FFCA3903E7189F7274248097D89E9916F025B9B23E591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627428318, "uuid": "0e9e0111-e2fe-4066-9bae-ce7b8afc1683", "value": "768:7heZbqVnHRd4mwSzxxwRMsX5gkfv+OwFMrO2JgGlzDpxYsYrHMd9Na:78Zijbts6kfvCYVrYDrS9Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627428318, "uuid": "f5502182-2854-4c03-b33d-91bc687e41fc", "value": 38648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627428318, "uuid": "e37b902b-4bf2-40ea-8c39-095046ec6cdd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627428318, "uuid": "cd8d62d7-9f4f-437e-af09-c597b8b84036", "value": "f81ad3b7806b6212d99d13043c3c1790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4f9606-eee5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627395714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395714, "uuid": "e8f1292e-0adf-45f1-8c8a-2149924e83a1", "comment": "Malware payload", "value": "6a0ba4d59d4b6089b04c26720cdc1106", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395714, "uuid": "f5588e18-9a9e-4b12-befc-430be35f1f2d", "comment": "Malware payload", "value": "88283b3c40bd8916565902ea6b9ee16edd41ef1a5f539329588945c48cdcb035", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395714, "uuid": "10ac22f9-d933-4d9b-b3b5-306b34da8f68", "comment": "Malware payload", "value": "f4a105995f09e31c43589d23c0e785a7c184aa03", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395714, "uuid": "d960457d-46bd-4ca4-b0d3-c6c4aadd82e0", "comment": "Malware payload", "value": "cec3ee3ecfba7d156aff9a025ae6f9fd189ba293a880eeada63a1e4399109a89f0c7645a3db3150a2cafe54b4d0a6c3c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395714, "uuid": "9dfb86e7-195e-4b0a-9557-71c46acfaf37", "value": "T15334FBE4688F48B2D2499C5E6494B145AE74FEE334C5887223AFD434DF5ABF29EC4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395714, "uuid": "3cc431ab-f682-4751-9855-ecf0e1b3c4b5", "value": "1536:iqW7qA4b64SVTDuhrNnlwrnEYo9V2A0RowKxvVCpBdzFz76mAg5eeVhMDw5wfLT:iqW7qA4b64SwvrgBdzFtr5RDAw5wfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627395714, "uuid": "30f5aa5f-3e3b-49ff-a02d-dacec49ab613", "value": 234652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627395714, "uuid": "55b8f0e2-4a68-42e3-9b6d-63a38fec117e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395714, "uuid": "6f1d7be9-d9a1-499c-b4da-7155cf7c821f", "value": "30003547748763 Quote.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71761306-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627399773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399773, "uuid": "bb2866f9-8612-4151-8d8c-190491888059", "comment": "Malware payload", "value": "acf333b6b5c2b1079ba9a21b343e8163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399773, "uuid": "7c4b83ed-0b47-4c24-8037-eb4551aa6364", "comment": "Malware payload", "value": "889432c2ca76ade6e99f3a14a81ccbe52f2ed1d44b5d84405398e7fe49feaafd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399773, "uuid": "6ac0a998-6197-4cd3-a3e6-f9d8709cf8fc", "comment": "Malware payload", "value": "6ac19d75697541d59e2dd489819aa4d6d84638c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399773, "uuid": "4c1b7db5-21dc-4ab3-8079-fda10eb903b4", "comment": "Malware payload", "value": "6702f4b4543abae81ea5424116e822c7789e8570f444518a94dce91ad4e217ccf7fd1c224b7e9bd8c0ab757bef80abc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399773, "uuid": "2c4e6a9b-06c3-4840-8021-44bc1ded73a2", "value": "T1CC45C561068FC7BFEA6B13B0082C049C95FBDD29C209F979BE1E4C76B562FE5013A585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399773, "uuid": "421322b2-a479-43bc-80c7-84744bf19d81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399773, "uuid": "7e7e98b1-9f21-4c13-942d-1a6131c5b791", "value": "24576:QxYA4dDoW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChi:7N17iecl/vasijc97j1jg81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399773, "uuid": "58104413-781c-4095-b80d-a33390bb895a", "value": 1270272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399773, "uuid": "6a36263f-3f86-44e5-b6e8-92dac509489e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399773, "uuid": "be0b28a1-e6ab-41f6-a90c-2b8a1816b39e", "value": "acf333b6b5c2b1079ba9a21b343e8163.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9f73a1-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372148, "uuid": "1a2a6cb4-eb37-4e9f-9028-0e0f4d8b345f", "comment": "Malware payload", "value": "978b040be4292e7eb99e70432a133f50", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372148, "uuid": "b609c358-7de1-4e5a-8665-ab3cae69c085", "comment": "Malware payload", "value": "894c98ddcd0a6c743512480c44002a53554186c7f06c5f122878977a74b8cb70", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372148, "uuid": "39435031-a9be-4618-ba6e-732728928fda", "comment": "Malware payload", "value": "1719746030549b38d536e05da7b919efe3eeebea", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372148, "uuid": "3550076a-36ef-402c-a64f-c7dd806c0dfb", "comment": "Malware payload", "value": "28d032b3eb0e86d768e2ff30d4e78d9b6b8b72e5c2bf4bea17b7bc3634dfa1220803a1abb1c0f1aceb04a218cf550256", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372148, "uuid": "998d22ea-537f-43d2-8f60-b3f10d16a7f0", "value": "T14181F8B069B544C2CF4BD1979C76FD2340E2F854CECF42C8361CFA660B0B3664C5A592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372148, "uuid": "631ac842-a25e-4b39-b439-c218cec70999", "value": "96:uHvlvZG1G57D3zRy4wiVuBv4B1u+rYuF268Mw+nWmjmbABCj:uPlvZmo7PRRV6wJrNs65BSbABY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372148, "uuid": "07660edb-a606-4bc8-970d-22c1335399cc", "value": 4010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372148, "uuid": "512c3c96-311d-4e10-bc65-5d625ed33c7b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372148, "uuid": "d9ed0f7a-61e9-42e4-9f94-f4b7a3d1fcf8", "value": "order PT Macropharma.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5147164b-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627401866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401866, "uuid": "ef75956f-bfdb-470b-88e2-cbffbd84edb2", "comment": "Malware payload (Loki)", "value": "c8bdd96544c62d471d6fdafc50fe3d1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401866, "uuid": "23f37986-6411-47a2-bbf0-d6951bec1fb2", "comment": "Malware payload (Loki)", "value": "89b691f7c5016920b20535dc985904842bdf04ab6a8dd34f1716883083b3f47c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401866, "uuid": "e38f8828-f353-495f-9f3c-d14c050f83d1", "comment": "Malware payload (Loki)", "value": "077f24abd08aa3d85546705c2fd61f687bf60649", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401866, "uuid": "2d242828-e237-4eff-bc40-17ed2818a12d", "comment": "Malware payload (Loki)", "value": "8e0aae380dff954504968b7fcca343c8daf6fb86629b26e47814ca4ea8d7303df84bdac78aa1fe3ae1497371ddece03a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401866, "uuid": "f0935c13-e8a0-431c-8cb1-2b09af4a76c6", "value": "T1ED44F19C4B09C9A1D47260B842A90E732FAB1739173F98D75780747ABCB7AF1A13471B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401866, "uuid": "a7d48f18-b4f6-43b8-8bf6-31b72c8b87b4", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401866, "uuid": "ad86c572-0795-450e-8991-5d1672c1d5c9", "value": "6144:ed53TvpHeIl0gaaKQQxD2rxOzxjrC7BsPGaJ84f2vY2vG80hnjqdgdKsqm:ed53TvpHeIl0ga6QD2rAjO9sPGaJ9p2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401866, "uuid": "4c157a22-c4f2-4a36-8120-aafdf1d330a0", "value": 257401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401866, "uuid": "86e2990e-817e-4dbf-9ce2-e7e06af85014", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401866, "uuid": "eed144f8-666d-4d95-a37c-ba8b38634deb", "value": "c8bdd96544c62d471d6fdafc50fe3d1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b303696-ef35-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627429827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429827, "uuid": "e9a5d421-7aa9-4571-bc66-489022f369cf", "comment": "Malware payload", "value": "9f049132f0c15e8687a0b670deab0960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429827, "uuid": "f0ead2f8-e114-453d-881b-b8dc5fdad1b6", "comment": "Malware payload", "value": "89fd73d17d825a1e661f69b41ffd9fcd9f5a3d044159763cbc82ffd0210eb78a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429827, "uuid": "5ae8702a-7f57-4370-aaaa-0271ed14cfbf", "comment": "Malware payload", "value": "37ded4a6085ad07cfbc97ac43d8fcfa5c81e8cbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429827, "uuid": "5c1f0362-8a58-4aff-aa5e-d8cbbecbeb24", "comment": "Malware payload", "value": "5c74f018d89b3dea90c22ec43df005a4a2a425c311ac91bf08ae899fb7d73a803dd03e40c709727915fb6febde57489e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429827, "uuid": "9b227614-5b98-4c97-835d-60a5bf1d2771", "value": "T11FE4F1093B80AF8EC56B4D3B84915D10EBF2E52B670BF7877CD312EC584E7998A17192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429827, "uuid": "9f0246c3-f80d-475b-9459-013129d7f04f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429827, "uuid": "7932e6ae-35eb-453f-97f2-26ba78db55db", "value": "12288:r//PAuIyO7H4N4z9IB/aP72aSiu/9KljHH1gWA34V5XmdLFmMCFI5YR9032nLEx4:rHPAsN4hIBCziV/9EjHVVUFmSAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627429827, "uuid": "4154ad56-64a6-4ce3-b93b-db1abece6994", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627429827, "uuid": "a01d3c3d-1743-4d1f-b080-cdf21cf262d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429827, "uuid": "7e499b6e-cddc-4576-a699-ecfb112d5608", "value": "Invoice #210722 14,890 $.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0ea7b7-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627413801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413801, "uuid": "fb512da5-a908-47c9-a996-f58922935505", "comment": "Malware payload", "value": "5df10045eb4e2357e599ba63172a973b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413801, "uuid": "c46c50b9-ad6d-4369-8ef9-bcd4ac2648ca", "comment": "Malware payload", "value": "8a99779eecc947c22ba50209c3b295f9eabe5f7dcc2edc522c21d8fbf6334a05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413801, "uuid": "fd7286c6-c7c1-4074-833d-0665f3c9c7f1", "comment": "Malware payload", "value": "9fbf0b0b1a1544791ee83ab08492455f63225e69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413801, "uuid": "c764b906-718a-4a7b-aee1-6cdb2e6994de", "comment": "Malware payload", "value": "21a1a0b847e18f8a89e71942563f82cd4ad0d1976338af61f48a823b0bdb9b40764140f745f90eb47796f015926a748f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413801, "uuid": "da5c2317-b6ff-41fb-8c28-b0e75c542e69", "value": "T1A6530A817C90AA29C7D0577BEAAF108E3354ABD9D0DB7347CC044B917ACA90F0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413801, "uuid": "bc840fa3-c4f5-4d3e-b1a5-7148b5a55c35", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yvck6YceZWGzDwMH:dOxkyRWiPkjX0QckVcwLlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627413801, "uuid": "71032090-353a-4698-9957-3383abfea225", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627413801, "uuid": "05ea5afe-7cb6-4bc1-aac3-48ba975381bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413801, "uuid": "6367baa7-a55b-400a-a639-bbfc3768c4cb", "value": "5df10045eb4e2357e599ba63172a973b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46085abb-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627375648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375648, "uuid": "ccdb684d-8c54-43ab-be4e-2e6077575a7a", "comment": "Malware payload (Formbook)", "value": "be35f0ce65b229e225d6c65b48704a2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375648, "uuid": "de0498f9-b513-40e4-8716-1f9a4be8b03b", "comment": "Malware payload (Formbook)", "value": "8bc53adb417402cf954d8018bc35c0f4f853d5a2e3471c4de98ca8e1fa8fa1e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375648, "uuid": "a7917fcd-d90b-4382-b460-c77c1744c055", "comment": "Malware payload (Formbook)", "value": "0f47018085e461e2b138e501393c94a173d90269", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375648, "uuid": "b1d87f7b-aa8a-4792-96d9-124fbef6a215", "comment": "Malware payload (Formbook)", "value": "438b2414c38d1e3d78e5938b3c255a5cb3501f08dff3a0b745f9039c050b024b245041d56f20bfacfba838d36a8d2ff7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375648, "uuid": "8d46a4d6-b7f9-488d-b5d3-b70fff387dbb", "value": "T1EDD4CFF1193E7B0BF09309BE207251A319A444E9CC79CBE4F73356A7EF1656B608178A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375648, "uuid": "e4adb822-ddca-4a89-90a3-5a8f277d218f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375648, "uuid": "5616ea9a-58d6-4c32-84e9-87e7edea8449", "value": "12288:pOsBgo0q4wMuPqyK4GjKKkk9CU+kQSmboCtcShnSZ0:pOsBgo0q4wMwK4GZYU+np5hnSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375648, "uuid": "2d81769d-f580-47c6-912c-0f293aa9630b", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375648, "uuid": "cd569c5c-12c1-43e5-aca5-99ea773ad0e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375648, "uuid": "08492574-5dcc-4d2f-a8ed-ac682ecaabd9", "value": "be35f0ce65b229e225d6c65b48704a2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5bfde0-eec9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627383475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383475, "uuid": "0f5138bc-7336-4d34-a4c2-9028d473ca76", "comment": "Malware payload", "value": "fb0dd1bca1b9ae78bd60855691521e65", "object_relation": "md5", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383475, "uuid": "eac6cdbd-43d9-4f62-ac44-4b762c499d5a", "comment": "Malware payload", "value": "8bef7b86043f758a775a9cf4080f5b87d50df4778d03ecd94989f98cc5c91e75", "object_relation": "sha256", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383475, "uuid": "f0dded9a-9048-4522-8821-67035a3a5419", "comment": "Malware payload", "value": "ed023257e130227796e6e393144cd83e2c564b84", "object_relation": "sha1", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383475, "uuid": "d2e80d4b-c2d3-4c91-8652-4e4002a7ab9d", "comment": "Malware payload", "value": "8977d922e4ed29977228c5c7142c787b4b6813ae799a49c65d62a56e5159fb759278b893f9dab5cb225969390463fe8b", "object_relation": "sha3-384", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383475, "uuid": "401f4597-c51c-42ad-a673-7e9c06aba9e2", "value": "T161B512A6FF8ED016C0DBE135A32C9547C449908B1508F69B6B34A24C4EF6DD49B4BFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383475, "uuid": "74aa64e3-2c3e-4e69-8e95-38abc34ea7fe", "value": "49152:9JLR8lsf5GEiKztMkRYSux3jLKpkIL3O1GkDl46lYkrTfbGOKVSy9SusqR:91Ra65GrKtySu9jCkC3O1pvl5TfCOjyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627383475, "uuid": "e3c80268-c0ad-4e1f-a34f-c3eccfcd48fc", "value": 2320781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627383475, "uuid": "988881a2-605e-4825-8018-8a70379e005c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383475, "uuid": "2b5db974-3b9e-4480-8df9-38ffdfad1791", "value": "8bef7b86043f758a775a9cf4080f5b87d50df4778d03ecd94989f98cc5c91e75.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6ee832-ef2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627426819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426819, "uuid": "12a76979-11a7-4281-84a0-379089d0f6b0", "comment": "Malware payload", "value": "ff04759814c2d073891948aa9b4a6c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426819, "uuid": "a1023eaa-4fa9-43ac-be75-6484c5fb8fba", "comment": "Malware payload", "value": "8bf9ae1489a0184f2e5f3ee7eb06602a69393317e20731ea649be7933b2781f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426819, "uuid": "1bb11792-f6dc-4435-93b4-831970153225", "comment": "Malware payload", "value": "cae2589775cabffe843518f08c85cda7fd14ae1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426819, "uuid": "14349bea-8ee8-4a41-91a1-b5b8cdf6571c", "comment": "Malware payload", "value": "dbf952092a4793398a904ae763dc5e48fd8db92603c7e202710ef525f558e6326e86acb1232b0706dd1836945d47d61e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426819, "uuid": "2a0b2293-2dc0-475a-917d-4a2d5cef3a30", "value": "T1E425AFAC7253719ECC27C5B29D685C60EA25783A531FC217601322ACED7E5ABDF901F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426819, "uuid": "07ac6ff5-9ea6-43da-8d46-429bf37d8b23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426819, "uuid": "57c66b9b-431c-44d7-a7ac-534b51af35b7", "value": "12288:/bWfecHe0b97/0cuHY4MbaURyWI9DH52UIQi/js4yyaUVKnpF19sgWD5FO2HXjNd:zWNHeKbCYVaeIKUCsUahpFnsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627426819, "uuid": "3c3c3872-edd9-4c7e-8bb8-d0fb0576a675", "value": 984576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627426819, "uuid": "108debd9-220c-4a09-a00c-e402dc646b26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426819, "uuid": "4d3723a2-0ad0-407c-a6d5-48e9872065aa", "value": "Request For Quotation-(EMP2129079970).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b638515-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627366316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366316, "uuid": "4665c419-03bb-4cce-8622-12080187fd4d", "comment": "Malware payload (SnakeKeylogger)", "value": "271c1d0808fa3f59180a2fc67ad62628", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366316, "uuid": "31585f79-a31c-4437-b327-75965a3c1933", "comment": "Malware payload (SnakeKeylogger)", "value": "8c92b75da56273d1cf85dbe57580cdc092fa3b71f13f5b1219326604f6cde8de", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366316, "uuid": "6e2786c2-6d7d-4a02-8f55-0c0f15b8b5d5", "comment": "Malware payload (SnakeKeylogger)", "value": "7925c765ed4def3749a43cd4e0da571b7868b846", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366316, "uuid": "2c50be56-b950-4374-8761-3b5d57e16eb6", "comment": "Malware payload (SnakeKeylogger)", "value": "346ed07b066a106048883212d70ef63b5f4c8762a206027971e7ad111b425cfb0a4e2aeb9520ecb5e622c863542deacd", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366316, "uuid": "278d96fa-21b1-4edd-9f13-e9460336ab73", "value": "T12D7423C4625910887FA2C6B814FEE5CD6293BF67811112CBEE154B9BFD1F94324DACCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366316, "uuid": "79aa681f-23b0-4728-9deb-a28eba3e6536", "value": "6144:5l7TD9XsVO4at/MJXfaA6j2r6wQ3kh5bl9E7gqU9CdoLc3K3t8:5lTD9co4K0Jv182rEUh/95qU9JN3t8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366316, "uuid": "07481aad-8106-4c6d-8197-500019946407", "value": 343336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366316, "uuid": "2b27c7f5-8881-4621-9379-c7990bfc8bdc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366316, "uuid": "c5b32850-86b3-4d3a-8736-24d79d2a2fed", "value": "000900049000T2000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dbe0ef-ef2f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627427463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627427463, "uuid": "3e617e0c-bf36-40ca-a2c7-6f66c8f30a35", "comment": "Malware payload", "value": "f02970cc3c958ce5d8fec3367cb19dce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627427463, "uuid": "d3e9a504-4bbb-4e6e-8e86-9ab0dd333110", "comment": "Malware payload", "value": "8d706a559621c1ec74e346061820da982e2740ca365f152660cc302162073504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627427463, "uuid": "c913919a-d907-4b72-9881-bdef405afbcd", "comment": "Malware payload", "value": "444d4ff3e6e0b2bd09f21165f2340d6790ae7c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627427463, "uuid": "9cf6f9db-ca7f-4ae5-9733-3483856b7dd1", "comment": "Malware payload", "value": "7cd21d4fe465386f91ed5b2340726b41725d657be96a673ea583a0933ace42e27fa5bb7885083e99358546af2369e0ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627427463, "uuid": "bf4024fa-ffae-4238-b5b3-5f30b807b7fc", "value": "T14244BF6BF5C469F1D92486711B04E7F0410FEE79A229C19B3BECEB4771190A3ADFA244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627427463, "uuid": "6efaef41-2705-4c8d-9cb3-9fdca3361a23", "value": "d2bff9423937b15e518b0d5c38cad8ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627427463, "uuid": "6f64a67c-7dbd-4093-b78c-bf9ff3ebd888", "value": "3072:Dr3lDXzSPWbkKAzSJXbERVNxlxrls9yXEnaHTVkY/9NCwGAH7rMq6MY6C680s7:tXzSP/GbERVfDy9y/HTHoGH7N6h2ds7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627427463, "uuid": "42999b20-0748-4bcd-a1e6-85af9445b8cb", "value": 265040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627427463, "uuid": "d995e6a3-e663-48c3-a0b5-5c588c3ef850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627427463, "uuid": "6b086bfb-a23a-4807-bbc3-500ecf21b5ba", "value": "673 (Mamba collaries).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fe5781-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627384928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384928, "uuid": "b788981e-ba7b-4cbc-af20-ef1ac1ba9529", "comment": "Malware payload (Formbook)", "value": "fd84eb337a51966294ba08722170bf46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384928, "uuid": "0632c4ce-5fb0-4485-8bfb-53dc5489d6d8", "comment": "Malware payload (Formbook)", "value": "8da806444010084307c77bf3a69f66ca36c15920bd7b9f60fdcf35fccd460701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384928, "uuid": "b9c07004-4b45-4a53-8d7f-f9e771b972e5", "comment": "Malware payload (Formbook)", "value": "1f529d60e2dc50deaac59af322708039da33c3be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384928, "uuid": "1242924a-9a28-4fc6-90eb-8d85299d054d", "comment": "Malware payload (Formbook)", "value": "88a30d7faf3a7d71dae49f8fc00c459256bc2ba0c1a40fcf5868134846dd9f00eb2cb6268de94d8d989645c2fd41e46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384928, "uuid": "694503a7-cec4-48de-bf41-7e73d4fd3431", "value": "T10B25492439FB502AB173EFAA8BE47996DA6FB7733B07645D109003864723A81DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384928, "uuid": "1203b7cd-82af-4eb8-b03a-011acb8c2760", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384928, "uuid": "9ad7fa4f-b140-4ffa-9019-2d4e12b697af", "value": "12288:rFhlsU1cTDO+emag5IFyPK7yMmeP1vwdyAook1GZEUFA1Vk82C867LiuNyxv2AdU:rFhlXcOyeL3JStX+PbLk2QHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384928, "uuid": "7abcf259-7a3c-4ef4-8f73-6ae5bd22db5b", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384928, "uuid": "b85d689f-52d0-4c42-b46b-460edf1ac321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384928, "uuid": "e72ca816-1ace-4286-9a39-501b63933054", "value": "Sales Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6e3489-eeb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627373216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373216, "uuid": "68fada8c-8d96-43b4-9c0d-c7b663aed870", "comment": "Malware payload (Formbook)", "value": "0b88672aa208666b2a856b6637517d45", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373216, "uuid": "1afb48a9-5906-4026-9765-6d0c1842a50d", "comment": "Malware payload (Formbook)", "value": "8e2417d7d83848d639c70725fc66a8d81f46bbbf936b1442fd649ff4f2885c54", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373216, "uuid": "abebeed0-4688-4287-8531-a15961e20a87", "comment": "Malware payload (Formbook)", "value": "6a255c999480b1dc260944d0aa10eebc11cdd994", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373216, "uuid": "38cc0ecb-70a4-477f-a615-378087a3cb35", "comment": "Malware payload (Formbook)", "value": "6cedf33e67bb571e17657ef46c58342859fc7044062535f44221e596946f3ba4e79cccbb4e613a74009089185447aa9d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373216, "uuid": "56cc45a7-3360-4f68-a8c4-0aa2f304a848", "value": "T13D451236ACC2A6CFC156B47CEC4B8650CAB7EE0796408E427394F3FF457966D768084A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373216, "uuid": "99cb9bd9-66d0-46b3-ace6-c64ed3a480a3", "value": "24576:O45sEe6KLpeVnNykHRF23+6ksQFpdY12KooicvcXjkOV2Ik+NMgGo:OQu62pwR8ksQ7dOSc0zBsI7NMgGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627373216, "uuid": "8b36795b-ff1d-4577-ab5a-aecf769a5a39", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627373216, "uuid": "1e6b134d-b310-448b-aba3-cc227bff940d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373216, "uuid": "1aea9b9f-0daf-4fed-9195-d4b90b3fa968", "value": "GLC-2021-E025.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d1c539-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1627399829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399829, "uuid": "22425933-4803-4b69-aa2c-8cb1341f6497", "comment": "Malware payload (njrat)", "value": "8930d9c5e595826dded78ed9a88b1f41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399829, "uuid": "3b91155d-3147-48c9-bbb2-7b81a0215715", "comment": "Malware payload (njrat)", "value": "8e8e647de94da7bf73ce5c62e5bbe687692f5f783ca94f8337281fcca4e384d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399829, "uuid": "f6698afb-a9e8-4678-8952-b89811da65b9", "comment": "Malware payload (njrat)", "value": "e4a704f1ea2746e225351da3d5950a27fd607430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399829, "uuid": "640464d2-5368-4349-9a0f-4aa3c57ea7ca", "comment": "Malware payload (njrat)", "value": "c1e7b5ef45d50658c12409fbe0e1957b0a4e97cf520a7b04e565cd06ed820c0da86c988a7fed5b0e5021383d379e8095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399829, "uuid": "4816b564-d793-4555-85c5-45bc74848b87", "value": "T11715AD0427D88A6BF1FE57B6C0B392A1C3F1B461B92EDB8F5D8424EE1D1774099107AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399829, "uuid": "6d9757ba-ca91-4020-a319-4aa0f8ae435d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399829, "uuid": "ac08348c-f376-4ab0-8f28-f7aebd806917", "value": "12288:iMlzTCbJBdBS4msNUCe65frHMnz2R94S4KsfiSe6+fsHMAbpz:1Mbbdo4mz1U8z2d4KBF/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399829, "uuid": "519fd506-e061-4865-9bd6-7ce9074cc18c", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399829, "uuid": "63bf3983-f2e1-4da4-913b-5005a0fdd7e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399829, "uuid": "e4b40d68-fac8-43cc-8686-c8b73714c5ff", "value": "8930d9c5e595826dded78ed9a88b1f41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03aae1d5-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627372101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372101, "uuid": "58283fe7-3882-4af0-a672-84221a474821", "comment": "Malware payload (AgentTesla)", "value": "b156ed4230557289721a0256a6aa23ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372101, "uuid": "24e581be-fe1d-47ca-97b3-9f9ec4633473", "comment": "Malware payload (AgentTesla)", "value": "8e97e85fd5881e5f4f31f95f5bc13de014ab3a3f278fec651f5208a73f22259e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372101, "uuid": "f2980adb-cc2b-4cdf-9a7f-888628b940bc", "comment": "Malware payload (AgentTesla)", "value": "59d8da9d1c4ec783f59d9c6ba330e4392151cb9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372101, "uuid": "78c8621f-05cd-49b5-b3e8-67057d1fa865", "comment": "Malware payload (AgentTesla)", "value": "888b4012bc2ed06b99177bbf0bd9a3cb1f2ea11e11fc9249cad7a471630c8eaadf9115dd58da06fb0a042aa614364c31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372101, "uuid": "7cfb98ac-7e3d-49fc-bb57-a214518fbd18", "value": "T1F07360ACD48B06A8CF96ABBC271B6F85114C766DF7849533327897386BD5C7A102383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372101, "uuid": "d066a4ed-312f-438a-a9fe-a42b25dd3e41", "value": "384:qimiv+tC5arsi3K1Ah8JO3ddEzfTpiJMWcgDAbehu:qnCsrsi3KiWO3QbpiJMWIehu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372101, "uuid": "0aed61db-5c78-485c-975a-776dbc0de9d1", "value": 77225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372101, "uuid": "26dd34d9-e872-493a-a29d-6c1b47b1ac53", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372101, "uuid": "06587587-2154-4b57-8b3f-206aad0e0645", "value": "RFQ No3756368.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db7bfd5-ee71-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1627345596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345596, "uuid": "c1a75386-ef6e-471a-b06e-1608f6b0139e", "comment": "Malware payload (TrickBot)", "value": "10d1600df09bbf61a041b667f0929b55", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345596, "uuid": "717e19b2-ab5f-4ec6-a7cb-a74f698d30dd", "comment": "Malware payload (TrickBot)", "value": "8f421ddf0df678fe1c22460e0fa3a10c7c48112197917e3843c5674ffe429503", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345596, "uuid": "26f1b165-5fed-462d-8ed2-dad78810c34c", "comment": "Malware payload (TrickBot)", "value": "2876dec17b753fe1514b7b6b89e1b626a8225426", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627345596, "uuid": "4d78cae1-9ed1-4f57-8e70-fb60af7f1221", "comment": "Malware payload (TrickBot)", "value": "0a69b021c4cb4faf2f651bc0eb07b951c613fa9ceca308fca6684246796953762a1b51937096416774674eb3e0ea126f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345596, "uuid": "4efcd062-f20e-4d11-92d0-a44ac09872ce", "value": "T1B7F4336FB8DBC537C5984966D054F594A94AFB780AB12C4C886FD0372EA9706FE383C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345596, "uuid": "01f752ef-d9f7-47bb-a14d-1ded7e80a358", "value": "12288:ix2qfl0lgVFukAuJHQwI5r1DwHJBQCrMyOCidyysMRUpfX/IpWJLQE4xI:Y20al8QZDwTo4iddjqhXgfxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627345596, "uuid": "f3bf467b-a598-4314-9a7b-be09d5c6b72d", "value": 741635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627345596, "uuid": "94686cd7-14fe-48ee-9f20-51cf57940859", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627345596, "uuid": "b3e16a4e-1801-415b-a428-93a510da0599", "value": "details_5908.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2d3209-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627366428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366428, "uuid": "b6f2cf56-76fa-4bac-9baf-2455c88d22ce", "comment": "Malware payload (AgentTesla)", "value": "bbe00988bde9e9521a7349c34e7434c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366428, "uuid": "5056109b-e491-4b17-b5ad-0c27efd958fa", "comment": "Malware payload (AgentTesla)", "value": "900a2c3d53f1ab70cc78952e8067aa1578cd0f7c137e59d0e591e823e89e1e2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366428, "uuid": "b2d84e67-d961-4eef-8cb0-bd532a43eeb5", "comment": "Malware payload (AgentTesla)", "value": "a2a31c05d0c80e77f26c4af726e9b066ba2f8a82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366428, "uuid": "71d8aa0d-b873-4dee-9653-0f251e347c05", "comment": "Malware payload (AgentTesla)", "value": "4366e5f39174e571c8d3889429396baf3b40640c76e0b0ffeccbd298f7833c8d8f5b6d8c6af3ffbaaee0ecaf30dc1a07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366428, "uuid": "9664227f-01db-4cb3-98ca-664d9357e3ac", "value": "T1E9B4239DA339890C50A5470C1CAD40711CEB9B8FCD16B3EA8169EFB38D46BFE4927895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366428, "uuid": "153307f5-fd8b-4e25-a7fc-559259caaab6", "value": "12288:UJm97a3lipt3+JSZCahpYRP42Ix1vKuoudmOT2HDNUPZ7Legh:cXl0tWSYRQ2Ix1vwudmOTfPZlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366428, "uuid": "27f1334c-c5c9-4bf9-b52b-66a707195acd", "value": 519079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366428, "uuid": "3a0e404c-8197-4580-9010-b618eec5dc2f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366428, "uuid": "dbed9b0e-7a3f-468f-8fab-e3ee0d50c881", "value": "Payment Slip.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a87a46-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401840, "uuid": "3c755f58-1aeb-48de-af7f-8b7052e098f1", "comment": "Malware payload", "value": "c62b99c24181e32a199909b7abc7bfe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401840, "uuid": "5ca489d4-c3c8-4fc5-9520-d5a342ddacd0", "comment": "Malware payload", "value": "904ce2cc4a696ddc786ab3a74f7e301e49ff555bac6f2658a336b408db927777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401840, "uuid": "ac0db12b-83dd-48fe-ad24-655d470df519", "comment": "Malware payload", "value": "612ba065ee0abdacbace51cc127cc6f10675836a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401840, "uuid": "e6b9357a-b138-41d6-8a50-4a48c9f07056", "comment": "Malware payload", "value": "590ec1b0a8d1df358bd53d53955f0944117f118f7ce6f0caa87023e86419daeba362170a37cbe5350b517a0dc8214103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401840, "uuid": "4bc95c89-66c7-4aad-bc87-8e1706ab1a36", "value": "T158F4E074631F9708DD3887FD1C29915127FAA01EA31DDA783F9890BC7DB2BB81AE1641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401840, "uuid": "4be30871-860a-4cbf-a9bc-19dcf06ee7e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401840, "uuid": "316bb006-d70f-4b32-b01b-9edac8589099", "value": "12288:JhGjkLKqIU5LUYM/dfYXn7stCxKP80S4FT5i4/Pys7uhosyaUVKnp:JhGjsL8VgXnotCxKPLti4XdFzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401840, "uuid": "43d52455-99ec-4007-85ca-6a40f104edb2", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401840, "uuid": "f4c26783-763f-4c59-b033-3558bf1564d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401840, "uuid": "e38bc532-0b1b-4250-8bef-8d9bfe9adb2d", "value": "PO OPOR20068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcacddc2-eeb4-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1627374612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374612, "uuid": "c2c1fefb-8ac9-4b1c-bef0-6e26f141fbe8", "comment": "Malware payload (OskiStealer)", "value": "5ad9f6be601fb9f23677c239c91deae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374612, "uuid": "0ceb89d2-981e-4463-b953-2c6e4afd477c", "comment": "Malware payload (OskiStealer)", "value": "90a9ef1c549a9f2646f6c603e27570832f371d25d2fc4b967c96f55fa034e557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374612, "uuid": "f02f4621-05ce-49c9-a56d-4f9e199df2d4", "comment": "Malware payload (OskiStealer)", "value": "a0162b62231692e94ca41aac27cec6063179a9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374612, "uuid": "1933bdbf-8876-4186-bef1-ae6de8966479", "comment": "Malware payload (OskiStealer)", "value": "58e0f89d6213b9acd705953dad3b6d1ce00504b351a6d489a5ebdce03be58d24b7f1fed25e89afd840a103c799b1cc8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374612, "uuid": "99d64180-091d-4ffd-8e8c-e4a34fb745dc", "value": "T142640258BBADCE34E0C240BDA3796575423FA9F9130F94EB9701385EE492AC5CA31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374612, "uuid": "4322d131-4e9f-4ee0-bbe2-b47407a8f454", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374612, "uuid": "212e519c-cf45-4b61-8bc5-530458f7332a", "value": "6144:Vd53TvpHeIl0yL6PKXDiFachVUGeUap2nRcUn3GYUKxn8gNMoPPUbyK+LwiwT6Z8:Vd53TvpHeIl0yL6muFxhSGeunagIsnBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627374612, "uuid": "a0bc97d1-ad40-4e5f-8fa2-f6a99e44a91f", "value": 321216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627374612, "uuid": "cd782574-f0cf-47a9-95ab-aea939a8c62b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374612, "uuid": "caacdb3d-6287-465b-bbca-d3b2b889b26a", "value": "GHS5333HBC5TR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f408443-eecd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627385166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627385166, "uuid": "fc8f4300-c480-4b77-b148-2ba8b06ebb94", "comment": "Malware payload (RedLineStealer)", "value": "ab82200859c0dd239561d9befa438267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627385166, "uuid": "ad56a886-e1f6-4409-b053-99124966cf66", "comment": "Malware payload (RedLineStealer)", "value": "91949edb9145bda3b1336a5513c44707a86300ca5a378411c9bf8800b8127db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627385166, "uuid": "6a24e535-812b-4b58-944c-952151e19bab", "comment": "Malware payload (RedLineStealer)", "value": "226d8a156cd89db03dbf16edd5a4986ba5a0d559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627385166, "uuid": "ee52f22b-b3bf-4027-a8d6-5aaff1c5079b", "comment": "Malware payload (RedLineStealer)", "value": "18ee58e631e097201e0f409dbb6d6c5b243c443682479e520e697bfa6a9de697f6c000cfc6bd42590df5162f38d88059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627385166, "uuid": "cce085e9-0562-4c90-a5ba-85a3c6f36fb3", "value": "T1C5F533813BE180FBEB45947555402F7BA0F8D7DA522008DB3F26DA0D8F7C979E42689B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627385166, "uuid": "706b0c45-4db5-4d82-b2ea-6edd2e83345b", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627385166, "uuid": "0848e13d-de8a-489c-97ab-a4273c55e1c9", "value": "98304:xKri7ixZUvFyPxtWfX4MtZgP12nCvLUBsKaOJr:xKuWx+oPxtWv4Mt6P1dLUCKxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627385166, "uuid": "d67b0fa2-0bdc-47fe-ac5a-1e2ec92f3759", "value": 3371359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627385166, "uuid": "a9669dec-16e3-4799-adc1-e2a83295fc26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627385166, "uuid": "b66028e3-8131-4028-8c5b-febb709f9d41", "value": "ab82200859c0dd239561d9befa438267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e724de8-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627372199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372199, "uuid": "6c1ce83f-a395-47ab-bd70-98ad3332fbb5", "comment": "Malware payload (AgentTesla)", "value": "b8e12d23fa9780efb407c51dd8a3767f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372199, "uuid": "8beb36ae-a09e-48ec-82c0-d6bca48a60e2", "comment": "Malware payload (AgentTesla)", "value": "92f98059db2e215ef3ff991be89504eafea4e08c66753c9a480d03cdb0b9add9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372199, "uuid": "6833774d-2781-42a6-82dc-2013a6639087", "comment": "Malware payload (AgentTesla)", "value": "110487c60cd6507687a5d93b9fa2ce6e5dbd46b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372199, "uuid": "f2aafb71-6877-462e-9f66-cff97f13148e", "comment": "Malware payload (AgentTesla)", "value": "7ab83d0cdb2e70455d81c3323dfc6b49a98f5c0a9c2dd9666ecbd8e54004589c1e2c44beccf9c15059ca9df9475179d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372199, "uuid": "6ee192cb-df10-47e6-855c-3a4572888d00", "value": "T1EA45129E1C61FF12C6CA0D7AC41B6E135090FD2CE69C65A353847ADBB1762B0D6C8B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372199, "uuid": "40ebf705-9674-45a2-b8a2-cd8425f879aa", "value": "24576:LTeUrJ9GwdFVzh/u5mwYrjEBwn9hVpWSQDebMtH4w:LTeBwdXt/u5mwYrkkVjxbMSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372199, "uuid": "af7e3ca7-fc89-46d8-bb72-375672b76868", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372199, "uuid": "c0e6ca6a-d498-4564-aeb1-59a056eccb03", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372199, "uuid": "f7952639-6f5b-402a-8257-aa05fcc4e32f", "value": "US 74,100.50 .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8cd8fc-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372146, "uuid": "18186bed-2a0b-4e2c-949e-07357581a6e2", "comment": "Malware payload", "value": "e61b3849f4eccac9531e82466c663e84", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372146, "uuid": "dfe1dc88-0997-4a76-91b8-0435b9b0b945", "comment": "Malware payload", "value": "936837d58eafac529ab83d47efc08d77e5d821f7fcafbb2f207662c3d5b54a49", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372146, "uuid": "97f67716-c793-4682-ba28-255945ccd0ea", "comment": "Malware payload", "value": "2d91eae655bf7c8bc6036d1e0bd2614892fdcf59", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372146, "uuid": "19fdc1b2-c0cf-4c2e-918b-9b883ddf4863", "comment": "Malware payload", "value": "0fdcaa5c17f5f148047ee5d7b150eed7b068302fdeca1a532dc468a01d546aabb8ff8b55462ada4e2a5531649f0375bc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372146, "uuid": "b3f27489-bb65-4492-9c6f-f059ad141fb5", "value": "T13D610AB517755420ED7F86E5F672F8E103EAB1A984DA10ECF09E9B610347724EB12881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372146, "uuid": "0eb371a4-5f2d-49d3-b45b-1f0458ea685c", "value": "48:jX6CmqqxHMxVM6/6NyHi+qH61+DmzdWV4AqgwTEXVzNhyBdMYvwG89kvX8OEr2SC:LcqqxEYVxHVxqlu0pvw/OEPEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372146, "uuid": "342d7133-f4c5-4ef4-8a59-1f50a96eed5f", "value": 3219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372146, "uuid": "2aa5af44-1285-45a4-b569-ad9534bf1bcc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372146, "uuid": "b07bf587-d7ca-4d43-a746-3b73fd476b4e", "value": "REQ.14000145971.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849e9290-eea0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627365875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365875, "uuid": "dccfc48f-b50f-4aab-98fa-6f28c33cd052", "comment": "Malware payload (AgentTesla)", "value": "31d7c9de4d1b739ec63418eb198e84b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365875, "uuid": "c41bce00-7a59-48f6-9431-cd29e290b17b", "comment": "Malware payload (AgentTesla)", "value": "93709182d579b433aa5f5fe1e4eeba4de3b5e497f78a5ef34d35bcd981f49f15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365875, "uuid": "cf252a1a-28d3-49d4-b223-6653720004b6", "comment": "Malware payload (AgentTesla)", "value": "78e6aec1a778e901f289369ddfd2144fe9d595df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365875, "uuid": "0cfda7f7-d727-461e-bb00-52f34dbdfbb8", "comment": "Malware payload (AgentTesla)", "value": "03044f0c33766dcdee8fcd12783ff881754a3ea5ccf39d5b69c2d2d5b244cfe3c2bb19c2aea3aae1c937fd2a2d494c04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365875, "uuid": "f590964f-b026-42b2-9bc3-0bee13d5df1f", "value": "T109E4BFF935393B5FF49384BE54B45CA2696014FAC92EC782F32341AAEF0C49B99406D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365875, "uuid": "8383f368-c8ca-47c7-b44d-3ac5f635b18c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365875, "uuid": "a681108b-eda7-439b-90db-e05c649b1460", "value": "12288:nOz2v4SvqPzMj5FXiZI2DPYHaOh+Z6DQFyb/+Cq1qZEnbC1RQ29SIa7mo5oFCEkv:ne2AgqPzMNFXiO2jNOh+ZNF0FEnbH7mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365875, "uuid": "86c3e46c-0bdc-4c8a-bb2d-4f33f38a9b9d", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365875, "uuid": "64eafeeb-ec7c-4e2e-abc1-0aea0d987eda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365875, "uuid": "8e1c3f5e-6aba-45c9-98f2-fabae2bb14c3", "value": "ebuka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0aa8c5-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627414076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414076, "uuid": "705307cf-5bdd-49fd-ada9-22cce97eab32", "comment": "Malware payload", "value": "b4a47658fc40716737ab78635a148fd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414076, "uuid": "09b0bd42-9a88-48e2-9eda-2d81557848f6", "comment": "Malware payload", "value": "94ad3f487079d39fffa6ba16529db849c71eb5087cbf6747765e1a994d76dbee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414076, "uuid": "ab0c9ec8-3478-466e-aa0c-e7e7f960f1f2", "comment": "Malware payload", "value": "67fc27f9d8093b1598cc062c85a6b2d0d39bf04b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414076, "uuid": "dead237e-4257-48dd-8210-3f1809a76078", "comment": "Malware payload", "value": "b5e6ebe893ac9f96cbfce9e710b66590524dc170c424c9c761669905dbe13dbe8a66dd0c7b8b80563cf0b82d4ff4c833", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414076, "uuid": "518e7b37-cf87-4605-ad73-4d32a62e7ee2", "value": "T16A831981B9809E15C6C5177BFA6F108D331247A9E2DEB353CD145F6477CA82B0E37A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414076, "uuid": "5a645013-ef64-4b49-84e8-e8d2ab53a568", "value": "1536:29n7/xkRBFg3yFhk20WtEu+1F4YPjaduBcPYO9mrsplDKZUlQBKXAVan1X+F8JyU:gJTyHknWt/+L4qjmugd9mrsplDKZUlQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414076, "uuid": "eeb8f059-318b-4850-8c5f-15f674895a29", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414076, "uuid": "755d47db-9cd7-4563-a064-be6e82ee7e43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414076, "uuid": "6d6110b6-80e7-4071-955e-c547f3ff2d68", "value": "b4a47658fc40716737ab78635a148fd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eeb4930-eef5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402372, "uuid": "5aadd823-8204-497e-b556-5d523007931e", "comment": "Malware payload", "value": "098d627a93cd7687f54c4bd1c342e00d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402372, "uuid": "84da366b-349a-4aa2-8be2-7a0fe31bad5e", "comment": "Malware payload", "value": "952c1bc7773c529d609f5eac3d5268274cec23eb495ca6ce78a866a73f96aa24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402372, "uuid": "08762a97-d4c8-4428-a361-35001c62a6a5", "comment": "Malware payload", "value": "dadf67b338f8223d06312da5d8d4a338dde816f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402372, "uuid": "c3dfe800-0f6d-4cbb-923e-d6c74b53e8f7", "comment": "Malware payload", "value": "805b2c3c1b05d92a607ac88a2b3410f4311490c4c20c8c3b29daea96c4c827571831584b061808a8a1d6b5c54c3d7667", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402372, "uuid": "34f8a3c5-f1cb-4039-941c-cebddf95d920", "value": "T13144177067A7BD1BE809F9B0A703B024A5BDF1778A5C93D2A5C066299C75ED180F432F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402372, "uuid": "9fbc80ab-32b5-49aa-abce-e59327462994", "value": "cd2ccdbbf7ff5ffb1eee7d322c630393", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402372, "uuid": "304f1080-9b8d-4b3a-aca1-8874178a1592", "value": "1536:0PnwsR1K/131Tjf8XYzyxSykhEFTXVjV10GhTGsMes:0/w+1Y3BkXSDy17GNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402372, "uuid": "3681dfd8-1f5b-4785-af2c-67e1d6bffb32", "value": 271464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402372, "uuid": "1e6859e1-cd1c-4b0c-9cbc-9cdf03e691c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402372, "uuid": "c23ec1ec-1ec2-47ae-91e8-e7f8f1f865fc", "value": "098d627a93cd7687f54c4bd1c342e00d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67114a5c-ef03-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627408345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408345, "uuid": "e63830b6-0a50-4e1f-97c7-cec9fb6217e5", "comment": "Malware payload (Formbook)", "value": "90825728992d0ef937e2523370e34b31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408345, "uuid": "e8f8d9fe-7018-4ae4-9dd7-ae687b4c7176", "comment": "Malware payload (Formbook)", "value": "9598f7ebeef58e063e6e5de7da5ea2775991628d11c4fae3e3e2854fa22065eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408345, "uuid": "8fccf15b-cb54-45c6-be05-fdb21da96814", "comment": "Malware payload (Formbook)", "value": "7b9a3d06e10d3ccb32a8be5a98ec253bbc0bdebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408345, "uuid": "9d1267b8-b58b-4a31-a8ad-a9b2bdac9b35", "comment": "Malware payload (Formbook)", "value": "b81f360e596f86ebc895e4d029ad8c2d14304955e04e95586a714cfbc57c5cccc7b0429bdee6d41eaa7ba216dbd4fd12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408345, "uuid": "049049a4-88ee-4171-ba0a-5026978ee5d2", "value": "T16234125BB4F4647AF09225F987932A021FBD7C631FF009A2D340FD946A36887AD28757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408345, "uuid": "afcc1cb1-bc8f-4515-a2a8-fda00014596c", "value": "fb3173a5f2fac421132f53c478a667b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408345, "uuid": "359aa5b3-e76f-448e-a092-b753dcf132e2", "value": "6144:7LTfjeGh6euA5wo1YxPI1+ZQEtaKgfpGx8sipmMWVq:bfjDRX/K8+VaK+pGbiEhVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627408345, "uuid": "a1135fd6-8b7a-40d9-b716-46cf96dbec2e", "value": 251863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627408345, "uuid": "270b2dac-6c3a-433e-aff7-62c23a78e542", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408345, "uuid": "3380ea0e-4d38-4698-82d2-831039b63352", "value": "bobb4567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e9800f-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627396665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396665, "uuid": "9902de61-0889-454d-bc7e-73903c208552", "comment": "Malware payload (AgentTesla)", "value": "5c0bc7c7186ad3356a5f3b8d2134e023", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396665, "uuid": "0096051a-c7ba-42d0-872e-ee79a90389fe", "comment": "Malware payload (AgentTesla)", "value": "95cd0e8151fd80f473f886e8c9aa98ce10d3608a8ac9542d848634a3e0f80064", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396665, "uuid": "ed074024-202f-4b1a-a807-2ca2c9126f00", "comment": "Malware payload (AgentTesla)", "value": "a4bab1a1edea203951480df4c7b94ff940561f34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396665, "uuid": "97e209a8-133e-416f-8d77-53ab83142234", "comment": "Malware payload (AgentTesla)", "value": "38f42eaf4fb477fab71b5095fa0b708ec5cb989ae2dddb377514259ae21e81f1d4c2fd7eaa541da2289899a0ffbdb95e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396665, "uuid": "4f3d9182-0611-40aa-91f4-0951ae0acf36", "value": "T12191E7B66A7810A3CE4640FBE9B9FE0518E2F11586CB58C0B27DFAB2271F3564159103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396665, "uuid": "ee31e9d2-fa62-4e49-9ac6-fb61631dd935", "value": "96:5E6+iV89Cxz++CE8qWazYlA2GuqveTyBN5AAXJVP5i:mIWCg+CLp+v8Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396665, "uuid": "1a5cc356-0947-4d9a-bdd8-78b0b8670515", "value": 4272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396665, "uuid": "7f398df0-dbd6-40cc-8144-46ae1964c93e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396665, "uuid": "b5a929b9-d916-40b7-8e96-d16ae908d622", "value": "WELDED PIPES INDENT NO. 2122000642.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb12673-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1627396866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396866, "uuid": "d149766b-d299-459d-9c83-49095a74514e", "comment": "Malware payload (GuLoader)", "value": "bdd639e8b157eb6cc74e212c95c81c05", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396866, "uuid": "b0204bfe-efc9-4f97-ac13-e86147dac6a9", "comment": "Malware payload (GuLoader)", "value": "9696ed924c5455750f29aa76b242d1db8f3ca057f8edcd66494a001f8162cfb0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396866, "uuid": "76bc489c-3f5a-40a5-8ed9-e4dad0ec0d12", "comment": "Malware payload (GuLoader)", "value": "1778cbd160faf833117bcd74622d80e9e8b9d020", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396866, "uuid": "1c48d0bf-105a-4ed3-9d9b-1f10f533d9ca", "comment": "Malware payload (GuLoader)", "value": "767b15dde001b00fb89e174a6e56cc54d2fddf17e740aabdc7a56afdb95a2a71cabab5ff44d01681c21ddff211c772ed", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396866, "uuid": "54b38974-50f9-4887-9d1e-02fa52ca07e5", "value": "T18E451291EED1C53AE25737B6D833455902A9CC2F3D0A82DB53B43B6ED5316E10EA31E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396866, "uuid": "96dd48b2-ebd8-4fa7-b96b-e3789b72bf07", "value": "24576:Izz9zBVhwpCnI3cBeXibXcaDTjty6L6XL4j0uBasWzulC6CT25nFRDKTd:Iz5NVhdndBaiLcWTBy62XkjfaX6CT25i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396866, "uuid": "147e63de-80e5-4734-8432-4c24d38d4110", "value": 1258496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396866, "uuid": "ae9d43e8-c8c5-4b35-95ae-795ed35c8064", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396866, "uuid": "65eda948-612b-4c1d-801c-c94c846514e3", "value": "New Order L.P.B.PROMET .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27640a0a-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627396642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396642, "uuid": "ec1fb8cb-3a62-4190-8b44-46c71e6fbfcd", "comment": "Malware payload", "value": "e54c83541891a4639445d3ed568764f1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396642, "uuid": "ddc2a3e9-6846-4144-bbd2-b6aa2179322c", "comment": "Malware payload", "value": "974265d63a3adb74ff7536ef848f862819a8fc176a61775998c14c506ca99358", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396642, "uuid": "dfb1ef52-2c7b-4c56-a6a9-ed219e70b918", "comment": "Malware payload", "value": "c8165cd9704dcb8ff1973d63711d60d9a89a8c0d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396642, "uuid": "bbf2bef9-ed50-4082-8320-9efe2755fe7e", "comment": "Malware payload", "value": "b2ad203502f886542a64d5822ad6db62e5c983fa902b3fd772954ebab3f92b4116a073d1db6d10dde8ba831b2915311b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396642, "uuid": "3f92feaf-055c-41cc-ad8d-c838bcbee79c", "value": "T17626AFB876047DE6266F536BDA96ACDD03B6272399CBA4CD8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396642, "uuid": "6af330f4-025a-4dac-9111-89908d735be7", "value": "24576:PDvwoiKbOuQC5qGIA2OOu+ofdxm/ym/Y+3X35uoObfEs2EmXxkJs7xMpHdXh4IYs:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396642, "uuid": "7256a3fa-22d3-43c5-bf68-d3c4a5050d6e", "value": 4799717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396642, "uuid": "d0765de7-44c1-45e1-8a32-e3575182c567", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396642, "uuid": "99abfea7-7eb8-4c60-a9b8-4deb92d1c376", "value": "Platba_Slovenska Sporitelna Erste Bank.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef1c137-eec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1627382293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382293, "uuid": "93f793ee-9b05-441c-9a43-2fc09d31e470", "comment": "Malware payload (Gozi)", "value": "9993a88eb2653613791fb2082ccf056b", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382293, "uuid": "14a965f1-e6e9-4b8d-8582-1c62edfb7351", "comment": "Malware payload (Gozi)", "value": "9803c7d4eee85c4f0cfbfba410c171a0903b5ef610b0667bad7a0cc8dd787616", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382293, "uuid": "35a03a10-e380-4f41-8c04-c371981d0b84", "comment": "Malware payload (Gozi)", "value": "833788b583088d92994c22fd4329fa8d9c1b1cef", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382293, "uuid": "d17aa95d-399d-42e5-b0dc-2b83d911c40e", "comment": "Malware payload (Gozi)", "value": "193a2c39519f55f46a6a23ee10ac3f817e92da06b16477d826fa38ab0b629d762b8688bfbaf9d1c5eeef32482527106c", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382293, "uuid": "96cfce72-661d-4aa4-9f79-9ff959406dbf", "value": "T1A0326C0AD561E51CC53BC83ED12D01E1B64C23659B13F75C2865B9AD3B830A3638F2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382293, "uuid": "1aae85f1-80a6-4de9-9993-203c322d2c81", "value": "192:Hb3U6fu+TGXaFUlbVvevUqz9/wYjhZseINgSmfycZUaWp:73r2tsUlM9zxP8gS0yVaWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627382293, "uuid": "e3e5cae9-f5a9-4b6e-a203-bdcaa65fe667", "value": 11309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627382293, "uuid": "8dd303e4-c54b-4a9a-b726-7d66705fc79c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382293, "uuid": "814023cf-e79a-4c86-a665-8595a8c097b5", "value": "documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f582d3-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627413820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413820, "uuid": "b49b3d24-7c8d-4b3b-bc6c-18fc01dae994", "comment": "Malware payload", "value": "dba6d7c0d781cf800a626d13978ee7a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413820, "uuid": "09ba0ecc-16cd-43c6-9f16-7447ee24bebc", "comment": "Malware payload", "value": "983ed7c7e23e81bd3896854e4a301695a23c5a0a32425e30651feab3e7dc6d06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413820, "uuid": "063664e4-f00d-478d-843e-4b7e7d2a4678", "comment": "Malware payload", "value": "dc9019376d862b799bde2b65791789c9022bf0b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413820, "uuid": "da4023b0-5e60-40a2-a1e7-0d0868a2e2bd", "comment": "Malware payload", "value": "ee80efc50f6e93b1d2bf292de2934a11951982203025066c3828f4aec80dd27329d67a9a9917e51c6b011880ce32efd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413820, "uuid": "eedffc37-181d-40df-92a5-06c23fd3e59d", "value": "T14593800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413820, "uuid": "62a18695-b735-4cab-986d-6c6ffd538af5", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqxi:qCYxrKDy46Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627413820, "uuid": "8e414df8-a4eb-42a0-a826-47f9478d6eea", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627413820, "uuid": "7e2b6a38-5c06-4261-bba3-c385002abda1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413820, "uuid": "9739a382-6f7d-4867-b3e0-fc04cb889bc0", "value": "dba6d7c0d781cf800a626d13978ee7a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f549dc-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1627400824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400824, "uuid": "ee10395a-e97c-4d25-988c-1c45dca4fcbe", "comment": "Malware payload (CryptBot)", "value": "80395dd47ecf3e8b81c83f78ed43ee58", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400824, "uuid": "bc18a375-7a56-4120-aabc-9423747c375c", "comment": "Malware payload (CryptBot)", "value": "9960a4ad4563e70c0605116e37e733081d02fa02af27563d836d5fe71966b459", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400824, "uuid": "34b3ab31-43f4-4931-b260-bc5f375b2ff7", "comment": "Malware payload (CryptBot)", "value": "3792273e61908bbda20ecde76b634db70622cc49", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400824, "uuid": "44ec2c1d-deba-4c1b-83e1-3b9c8a7ba39e", "comment": "Malware payload (CryptBot)", "value": "8f978e16a849e5d0f9a59c2d6f03c47847659e02d8e24b2c95ab35c4917f6f20dbeac7ce8f4907e70f102a41faac90ab", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400824, "uuid": "bfd5af46-6ce5-41bb-bb87-b32da3985995", "value": "T104F4F120BF21C039FAB2D2F8057693BCE53A7AB09B3550CB53E519EB02246E5AD35747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400824, "uuid": "3bc787d0-4e02-4df8-b550-8b0b13edcb81", "value": "800102d28cf35c665bee356e0e434ad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400824, "uuid": "c9c649bf-97c5-4244-9b2c-fe32e792e17c", "value": "12288:EyfoPYG7Cs/eg1KIKHdedsfGvddcHlfKMhvdbyZECzVMoMi9W7f5leZlFFhMeG6:8R7Cs9Oe2hvRSVMoMi9WFled4V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400824, "uuid": "30311257-2050-42bc-a762-41ea3ba44611", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400824, "uuid": "3dae4955-3dc2-4352-89bc-f2472ac88415", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400824, "uuid": "9596e426-fd0d-4a44-ae88-4886efd8b570", "value": "80395dd47ecf3e8b81c83f78ed43ee58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b429a473-eebf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627379269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379269, "uuid": "c28b0738-bf34-4864-be24-79d71d3835e0", "comment": "Malware payload", "value": "ff9033ac53066027b864ec32f00ec938", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379269, "uuid": "b6135a38-5276-4ade-aa93-196479c645de", "comment": "Malware payload", "value": "99af18406b9f9d88db1a06195e1c54ca2c8407c0f0ec2aef64787b3a193d1b8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379269, "uuid": "874a15a1-c0fb-4105-a564-b402364222c9", "comment": "Malware payload", "value": "a4a845731a16e5db5ef6e1647aba9652d51dd28f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379269, "uuid": "cbdbcd31-6e20-46c6-a5c0-d578535295d6", "comment": "Malware payload", "value": "00817e877d34feec2fc1d48806d4cf684e54ec2cfce4bbbb0cca49ba0c10d3690b91c3afb34af87fcb58e954968f2b6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379269, "uuid": "8ea1838e-0db0-4710-a62e-c2c0575433f4", "value": "T19CB41236472BAD13D6FC023710C76E091EB49B039126E1FCF8DD17C6A6AA7522663F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379269, "uuid": "4110b36e-2899-4665-a216-f326f5d0ede1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379269, "uuid": "aa22a17b-e82c-4ea9-88ec-459980ba427d", "value": "12288:zsaYW47CjwyECJugDUgYErdRZgpZfGAO6Gj7RCioG:zpl/Y9rfa/j7R7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379269, "uuid": "5a93d0f7-ba67-41ee-8594-9878e7b21025", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379269, "uuid": "a2985800-47d3-4a87-8850-4de69ecf75fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379269, "uuid": "e257e220-32e5-4678-a812-de71ff1b9e46", "value": "ff9033ac53066027b864ec32f00ec938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e55a48a-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401861, "uuid": "75ab71d2-e1e8-45ea-ad33-c5d39f366b31", "comment": "Malware payload", "value": "88c79861db59b77929664c394e358d0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401861, "uuid": "067a400c-6da0-433f-a9ed-14994d1dcde7", "comment": "Malware payload", "value": "99f4c6bfeb08243dfb4bd9f5d8efd4a43c04564b5f1f79132ae9749ae749e9aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401861, "uuid": "b852a6e9-a85e-4d5a-94d3-0e699b568e2f", "comment": "Malware payload", "value": "a71ca0425134c53ee85c138fe0368bda5cc38519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401861, "uuid": "101baaa7-35ec-4917-a168-0040da638926", "comment": "Malware payload", "value": "996deec91ed75ec8aed385b8ded469ae66ced0cd7db39609668d022acdc5dbfc71b01227007b7453cb47fd0935c35840", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401861, "uuid": "44c3bfbf-405a-4cb7-a4b0-48ca0d9c8aae", "value": "T1E303E15D88D81D8DDD9DAE3EA2AD5723DF9891C0350F0B4F2B423C4CC62894BD9AE479", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401861, "uuid": "e32c32b7-7384-4281-bcbc-8b85fd0b312b", "value": "768:mCTCqdab2OtrXwmJ/UYB39nJWdbJcB23iOq/ouWRT:Lab2K7VB3LabiE3u/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401861, "uuid": "ac0e5ffd-2e23-454d-bef8-4f6884c42034", "value": 39164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401861, "uuid": "5f4572a3-a33d-4277-bef2-3436c012744d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401861, "uuid": "a61f4d54-255a-480e-9e17-cb824b829440", "value": "88c79861db59b77929664c394e358d0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ac1c79-eece-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1627385721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627385721, "uuid": "21f431bc-e30e-4f7e-9ddd-2c83bcfc75a4", "comment": "Malware payload (NanoCore)", "value": "bff0c36c3c73c83a4a144bb7b5874056", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627385721, "uuid": "101f62a6-503f-44fd-8553-9b76cfa2fa51", "comment": "Malware payload (NanoCore)", "value": "9a28b730d4601c17f4bffa6c63c681e0f3c95d9f8c95a700c2b77c2bdb2dc8f9", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627385721, "uuid": "8597d619-9460-4990-aa65-57395adb4090", "comment": "Malware payload (NanoCore)", "value": "4eaa93a36139ba7c7e60c90790ce3ece26b2cbce", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627385721, "uuid": "09cd50d0-9c51-4e2d-a892-6a53449a4d00", "comment": "Malware payload (NanoCore)", "value": "9a4c257789972a43c4b88af73c68f0094550570d532e35f01cb41c25ff273cfc096d0292ba3af4dc3a16d1c98e05a4fb", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627385721, "uuid": "a0f9d416-b863-4d64-985c-2fad654ccedb", "value": "T1B7E423BCD2F74601F12E7AB394DAAA98C30C75B91C5E207E7B852CEEC6141B1BC99711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627385721, "uuid": "ad6d0b00-547f-4b06-9084-2c722d481a0c", "value": "12288:z5u5HATikCKoKgbn7oBQcRi7mkEZ+ryW3+Ejo3T+zI9lhzs+yoUxtNSVM2xYqs25:w5gJoKgfEjZkHOW3+Qo3Tlj0xT5aBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627385721, "uuid": "4f24e23c-b0e7-4e90-bb21-1d62b1163f91", "value": 695857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627385721, "uuid": "81a4e5b8-e6af-4abf-8061-188b294d555e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627385721, "uuid": "b6e8498f-ed8a-4949-91d2-202a79744933", "value": "TT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa77710-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627400092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400092, "uuid": "5cd219cf-8448-4641-8ecf-791eff2da2de", "comment": "Malware payload (AgentTesla)", "value": "465925dd7f0d7f41b5fff771e3cb8358", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400092, "uuid": "3cec1452-cf12-4b12-907e-ea975b604404", "comment": "Malware payload (AgentTesla)", "value": "9a5ea80dc3f334116c002ab185a5f54f80c72bcd11fcf5051b0a2e3a7704a3df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400092, "uuid": "e762f061-2344-46cb-b4cc-388f7c06166d", "comment": "Malware payload (AgentTesla)", "value": "a7aa00da7f562e127c66e0c63b13ddde78fc3b08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400092, "uuid": "67c5a26c-d895-4113-ae68-817126de5030", "comment": "Malware payload (AgentTesla)", "value": "29afb26dd5bc55369beb6eedfe9da7df100ab04dfcc4a40832b43c81187808cc861609d2fb909caa46f2bc431fcc67be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400092, "uuid": "e382b92a-f928-4b90-843a-4294adeedd28", "value": "T10125F1663227A218DC3887F55C25D1B12BBE9C1A626CC3792DC8ED7F7DB32785AD0580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400092, "uuid": "608e6569-7502-4dfe-ad06-43271a376bad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400092, "uuid": "31921c0b-bc51-482b-b35b-f476809fe270", "value": "24576:JvDBlBPIOBPAprxrqGxcXNhJ9jXS14CR4:tpPDPAdTufjXS1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400092, "uuid": "224f33f9-cd59-43d1-9a48-a67e68e1b184", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400092, "uuid": "b04c8287-e0fb-4639-8f5e-a43423d5e343", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400092, "uuid": "bf2fc29a-5e29-4d86-8694-73f4beac4025", "value": "PO_DEA83657-ARF-(QR - 0621).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bb95d0-eeb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627373225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373225, "uuid": "bb29b16b-0e74-432a-9fc5-e5abeb5344e6", "comment": "Malware payload (Loki)", "value": "0274a495e9ef20a4b3bfd274695d79b7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373225, "uuid": "8be65e2d-a08b-41eb-a735-d60a532f9cb9", "comment": "Malware payload (Loki)", "value": "9aea6342f41054eab27667160a40eada41c346b75cd2d31977f6d65d63c00fa3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373225, "uuid": "22976211-4683-4d17-aa8f-6d1ddeaab1b1", "comment": "Malware payload (Loki)", "value": "90c81259b0c08ece4698d440cbbb9dd5add9a4b7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373225, "uuid": "f0e188e9-4c01-4f32-a11b-532d571c97b7", "comment": "Malware payload (Loki)", "value": "9581bf7dceefde022c20cb743b0aa571aed5380862233b0b898e2786ce6917824409be2cf6b6921f39be99802d370092", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373225, "uuid": "63bfd162-95b1-4351-898e-fd588126b068", "value": "T11655128CDA4D8BBAC58F5C72284396DF757C8DD4B20B7826781E728EEF70522B9D5900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373225, "uuid": "c0c1ba4a-86ce-477b-a4ba-bac55af86b0e", "value": "24576:wNJJq7bvozZ7VSw8zRPIfh9J87D8KeNfBv+/FEpl11NiCVfKnMSc3LdajWYXOrJV:17rozJUhCMsKi+/FEH11NikfKMBAC/6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627373225, "uuid": "6d493f64-121a-424d-a64e-2011045ac614", "value": 1328640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627373225, "uuid": "d4dd5145-31ba-4a7f-b904-846c81224665", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373225, "uuid": "42f02db3-a4cd-4fc9-a9a3-9d0628737856", "value": "Arrival notice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db76c1ad-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402098, "uuid": "4144ad48-f502-467d-87d2-df5b1a81599b", "comment": "Malware payload", "value": "9c15675d8963d690a26f99efad3749bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402098, "uuid": "d7434a39-060d-4f33-800d-45e667d60c9b", "comment": "Malware payload", "value": "9b58b81abf5c7b2d930f9546fc8aa5d3b2611891d8428468cd3f65141e7239e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402098, "uuid": "ee95f9a4-b8b3-4a48-b1d0-e697946711ba", "comment": "Malware payload", "value": "9e8adc79b886f3047b6cd5eb6dc2ffd9433275ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402098, "uuid": "4bcd0dd1-ef0d-4a77-bc3b-1711447c0913", "comment": "Malware payload", "value": "30008e1a0b435114c319a3cb80b543fbc34a068ce9d7a4705f8eaf8f6104e906014e52d2c006fb17f2b8a6a436c166cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402098, "uuid": "14cca67e-d251-44e8-a7b7-05cfca9784a8", "value": "T11FF2F1B18C46AD42E7880972FD3F0485A3C24BA355DA27287524A378FDF5042DAB9D63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402098, "uuid": "26e779b2-29a8-4a13-b536-601cdb05e4bb", "value": "768:WKemQK0dWjHk2b/ThO7dXHSPBhdv18Dc5woI1Pp+3Un:HeJKZbtOqDSEw3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402098, "uuid": "6df085fc-d255-442c-a818-8421cc7d3066", "value": 34928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402098, "uuid": "52d0cc40-e513-466c-853d-05ad8dc5f265", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402098, "uuid": "338ac1e2-899b-40e1-b72b-e760b1738900", "value": "9c15675d8963d690a26f99efad3749bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67b01b8-eea0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627365932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365932, "uuid": "61470805-0354-44c0-8fe1-286d79e39345", "comment": "Malware payload (Formbook)", "value": "881b344339dd9a0a1213e0c74750e562", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365932, "uuid": "445638e0-b35d-466a-922e-0982819fac2e", "comment": "Malware payload (Formbook)", "value": "9bcbcd1a0ff4f8c5f81c5172ae88f670e1e3b97687572ada4a2163204f8fae8c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365932, "uuid": "6662bb3c-8834-4b9b-b90b-c6203457bbd8", "comment": "Malware payload (Formbook)", "value": "a45581299cc50b734145e6554289ded6942c1c1f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365932, "uuid": "b57a4349-1d2c-42ea-ab4b-1aef43c504d0", "comment": "Malware payload (Formbook)", "value": "ab40268f3bb218f923938ef5e96e781328e785b189e77215bc0313f21d9d9b8247e35550382ad9a86b94cd5697bab007", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365932, "uuid": "f207b252-91b9-4377-ad5d-4a87f64d0f95", "value": "T169A423FC76A9D9AC6CD460F092E84744DC3FFBF1B09997C46D8B464798090AFE0A5E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365932, "uuid": "ffb905da-a4ec-40d3-9620-0beafbe97e17", "value": "12288:9G6LQh9lgQKylFOn1mVhBpyNCZ4C/Lqaci:9GJVxO0Bmt8Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365932, "uuid": "afe3f07b-cbb4-4bdc-8206-440d81049ab5", "value": 479454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365932, "uuid": "934c696e-b0b4-401d-9146-43ad405f4a4b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365932, "uuid": "41e0e212-44d5-4590-a7fd-8a2657582058", "value": "Invoice & Packing list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7257abfb-ef1f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627420390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420390, "uuid": "64135462-b409-4587-be76-a268eb51d0f8", "comment": "Malware payload (SnakeKeylogger)", "value": "6a9d0ec45e52137abf05b546151dc664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420390, "uuid": "95629061-713c-4ef0-a76c-0530a3768d49", "comment": "Malware payload (SnakeKeylogger)", "value": "9c247a73a2b93a70b14c37b1dbf564f38db8bb9a0e7160de1971655a4e02950a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420390, "uuid": "e8861ff7-83be-406a-a6b1-d70392f27c98", "comment": "Malware payload (SnakeKeylogger)", "value": "2ea215c3bac1316746fb0ddb9ad7be216a596220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420390, "uuid": "204de979-f3c3-4c79-881e-d6a9d8fbe862", "comment": "Malware payload (SnakeKeylogger)", "value": "b9330a46986b2db88b6fb10411a3e083c2bfd09a1a2faaa367a744a0e40dbf651340779ea605e2d6a978d7f55f61e5fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420390, "uuid": "6f5f52dc-40d5-443f-9ab7-dfcf78ace42a", "value": "T121359E24226B5F9CFD7DA3B4603C081887F4B906D369DE5C3DE600EE1961F958EE2B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420390, "uuid": "c1d56459-01f6-40bf-9bcf-9e8f637335e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420390, "uuid": "40002beb-5d9e-4b53-9124-9814aea414e5", "value": "24576:19e4yvDB4b4uR8wSGoDdVYQei/XtI1xv3:ZKyb4uR8wStxPei/qPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627420390, "uuid": "31cdd8de-8fc2-46b2-80d2-6da162079aea", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627420390, "uuid": "2b3ef771-344c-429a-b94c-1f815661b875", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420390, "uuid": "652e4a98-d44b-49c5-b344-72d48bfda663", "value": "fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea18d0c-eee4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627395124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395124, "uuid": "cefbe802-0bf9-470c-8455-af3d993d9cfe", "comment": "Malware payload (AgentTesla)", "value": "87fb6b88ed5e0ad768dd1fb8fc9c46af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395124, "uuid": "d30aed1c-979f-4afd-b3fb-2f9c24711594", "comment": "Malware payload (AgentTesla)", "value": "9cb1e7f66fe3c5e0ba2e1d525dddf593ceb57df41a49b874228c61322e6a4861", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395124, "uuid": "15a53b79-df9e-4370-9308-a14b5c975f53", "comment": "Malware payload (AgentTesla)", "value": "739749390782129616a8a776ff745a748de3048a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395124, "uuid": "a8bbe3ee-91df-40ac-a4f5-9e4f36804752", "comment": "Malware payload (AgentTesla)", "value": "5d6147ba303b2f1f10f1e59a2da289e6a142403abc91e031e2fff189dcf2b834ee76e700277a6b127a7c60899b464846", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395124, "uuid": "5ed65ed6-d381-49d3-9b49-64a508e3cded", "value": "T13025492439FA902AF173EFB54BE475DADA2FBA733B07645E109103864623A41DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395124, "uuid": "f19fa4f7-eec5-4f9d-b6e0-489bb17cf5f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395124, "uuid": "7a9c87a8-d19b-4c80-a616-69baff07c708", "value": "12288:GoVNKaNHKJLMWnnVZT9Tpl9VEE+y9aThRUg+dHGmdIb7ketS/9nQEchd5AasUm6W:GPgYnVsE+y9KQQ1L+ZUZPJZZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627395124, "uuid": "701c6832-6dd0-428d-8af3-25f56f25a742", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627395124, "uuid": "baae3748-a0d5-42bd-b185-b4bed32920a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395124, "uuid": "8229de14-c4a5-4ca7-99a8-997ff092dcd8", "value": "PO 98246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a42af1-ef21-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627421251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627421251, "uuid": "ae305306-dd33-41fb-a49a-8c9ca93c86fa", "comment": "Malware payload (SnakeKeylogger)", "value": "e745b5bb83dcd7045e2f1e6396d7e074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627421251, "uuid": "ebde7a34-93f8-4652-9fb1-b9b0866e25fa", "comment": "Malware payload (SnakeKeylogger)", "value": "9cb2740a3219b5aaa8d26ca22bf7a2088d66f1e1c37420dfe8121e0c5f0df2b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627421251, "uuid": "e9a28051-30b7-4368-a97b-0874e3892add", "comment": "Malware payload (SnakeKeylogger)", "value": "dc415847e2a782d2f714da53bb5a8e2b18a67f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627421251, "uuid": "71960177-0622-47df-a7c6-ed6b1a4af53b", "comment": "Malware payload (SnakeKeylogger)", "value": "34f217264e38d7ec8d4733c9e2113e9266a29bee9ada03d59a0693711831d357a39b7ff3c4e8ddb7ec2c229b4b20faf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627421251, "uuid": "19e74714-7f16-4e5f-9316-bd4a61aa2d9f", "value": "T1CB058D525DCF865EC2684DBA9731AC5282314DAA2649F3132EC174FDD93F2EDC89F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627421251, "uuid": "ca9da73e-9610-4ea3-9d5d-cd6112283003", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627421251, "uuid": "312a026f-60a5-4232-8098-4b2eb7462936", "value": "12288:zaD0UrBY7pVS/XO+0vx33l9Kt/KIB+75ZKRvJLnRfTxMESMPQipP5q:GD/BY7p0/wbY/KIENZKRvJLyipQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627421251, "uuid": "b1684f27-724a-400b-aee3-57caf2372c9a", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627421251, "uuid": "a4ed4b4e-4b09-49ff-9969-e7a8bb944f2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627421251, "uuid": "82213267-c8a0-4027-aa0c-c942503a71f7", "value": "telex SO#1KSZ019769-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04815f7-eeba-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1627377222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377222, "uuid": "8c08b78b-53fb-4e61-bc88-caee18cad1f5", "comment": "Malware payload (ParallaxRAT)", "value": "90c094f1c7846c5b55fba50b70b74425", "object_relation": "md5", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "A-LINE PIPE TOOLS INC.", "colour": "#68A877", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377222, "uuid": "709fb1e0-dc34-4a15-9de3-659bb63f2845", "comment": "Malware payload (ParallaxRAT)", "value": "9ccce653cb66833e9396151f5bc65f6c2744d955a9eaedad81eccd3da252803e", "object_relation": "sha256", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "A-LINE PIPE TOOLS INC.", "colour": "#68A877", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377222, "uuid": "6230fb14-5780-4a9e-98d9-883e3272572a", "comment": "Malware payload (ParallaxRAT)", "value": "8cc75d0cdb1cad30ec6600b1333a97f57e8d6874", "object_relation": "sha1", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "A-LINE PIPE TOOLS INC.", "colour": "#68A877", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377222, "uuid": "c28e6678-ccd3-4e28-8cd6-4d9b6681a932", "comment": "Malware payload (ParallaxRAT)", "value": "539930be4d77b7ea2ad91d1b20fc3280ee67366225c154fe0377f8c21954e63760795b0e8820fef06846ed763fc20afe", "object_relation": "sha3-384", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "A-LINE PIPE TOOLS INC.", "colour": "#68A877", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377222, "uuid": "ef90e7cc-f57e-4475-912d-559d74ab6790", "value": "T132667C217344943ED8AF0A3B957BAA20893DBB757913CD6657F49CCC8F355803A3A24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377222, "uuid": "5842af7f-926f-4476-b786-6cf5d820dcc3", "value": "11b3821451b56399e6339116f98b9cbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377222, "uuid": "36768541-d03b-41db-b8c4-0847a508592b", "value": "98304:rRjgEH86xAn/vk01SduC5z1YBM8NOiVKnp3bfXhvq8:aANG3kaSduC5z16AiVKn5Rvq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627377222, "uuid": "9cedfba8-e1ec-4cc8-a1c0-41f51a808104", "value": 6861784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627377222, "uuid": "4ab9c9ef-12ca-4a0f-ab74-f6d2d77ac6c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377222, "uuid": "99b7cc0b-5005-4ca9-b67a-051ea6da7d99", "value": "9ccce653cb66833e9396151f5bc65f6c2744d955a9eaedad81eccd3da252803e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebdcf9d-eeed-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1627399017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399017, "uuid": "c7f68545-01fb-459d-8082-22d950a8686f", "comment": "Malware payload (GuLoader)", "value": "3601ee54741bf58f64aa01c0798c98ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399017, "uuid": "4a53930b-a170-49ff-823b-482036dcdec3", "comment": "Malware payload (GuLoader)", "value": "9d32d8de3b01e191634bdd00355a38a310475b70ba31f69015b68db822995c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399017, "uuid": "7baa8a96-a07d-4fb1-bfbd-75a35b1ef5a6", "comment": "Malware payload (GuLoader)", "value": "9fbd9ee32263e04cb87fd8626ad623e8b90f6b2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399017, "uuid": "48507777-97d5-4ce9-8b94-dd4dcd76b229", "comment": "Malware payload (GuLoader)", "value": "0349337a4f3c806c60c496b5fc11df40fa1deff5d99d80abb20031cf3d7da0a163fc9923d26d96360c10a86b39dde595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399017, "uuid": "0049a4f1-991b-4e1f-a492-1abfa21913e1", "value": "T1DA343A43B6B24D29E1E62DF3683AB86273157C0159211E3F1184FFBE30B16D2A4697DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399017, "uuid": "81c52ca3-4dbb-4e64-b1ea-cdba9c377f62", "value": "5538543365ffa3683ea62d4da396a81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399017, "uuid": "b365a2f2-083a-433b-be39-555f5ec92463", "value": "3072:TM6neZzB8pltkBshWNeEL1NawfTuBWmknQx9Ov7R/zBHCt6:wT4kNFLCwfTOWmkI9OT/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399017, "uuid": "4d5dcbd9-3e9d-4c18-b1ff-40068af70327", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399017, "uuid": "6da35908-ff41-41a2-8d85-1eaa97e9dc94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399017, "uuid": "67cd2123-bf3e-4fc3-9b38-a225e4591180", "value": "Contract_Proforma-26-07-2021_RFQ_9R83374666446_QUDHDGEUWIWND.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f31451d-eec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627382106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382106, "uuid": "b3f3b357-f890-435a-9941-c5ab870c3171", "comment": "Malware payload (Mirai)", "value": "af2bb0fda10b47f633b33eed1ee02486", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382106, "uuid": "45fda8f2-a856-472f-acf1-116a68e3cf4a", "comment": "Malware payload (Mirai)", "value": "9d46a7fb121e6452649bf4dc98ddd7b017f5cbd582a44455ac7e81bb6e444390", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382106, "uuid": "5c2393ea-5e52-4d0c-b383-160c65418590", "comment": "Malware payload (Mirai)", "value": "6fa564d4b7e3e0cd96938bf49aaefe493885f5c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382106, "uuid": "7440eca1-e669-4643-ba32-7db541d7869b", "comment": "Malware payload (Mirai)", "value": "2058e899b33a91f9c75808a1487113af07a2893dc8e9ffaf70078b120ca0507bc34c7dbb9baf9d0a4e16e39c8497a21e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382106, "uuid": "06c442bb-c314-4fbe-a679-5034a8295b55", "value": "T13E23089BB840ED7CF96AF7BE8517060AB621329044A20B376367FD43AD73194AD1EE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382106, "uuid": "c2026809-1ba3-4716-b131-ae13b710a7fc", "value": "768:rney1nMa/R3cxt6Em9N/gWvX7OAgDp6+y8TxLtIVl8Q4Hk:L9nMw3ct6GWvyAS6+y8dLq/8zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627382106, "uuid": "7943451c-ce19-47b0-8cd2-67422ada684f", "value": 47032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627382106, "uuid": "4c9fc4cd-31fa-4b4c-813a-cf9c01e70883", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382106, "uuid": "a8d148ea-c6be-4ad4-96a2-f84ceb3d2ad7", "value": "af2bb0fda10b47f633b33eed1ee02486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8f7421-eec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627382100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382100, "uuid": "ce63fb88-899b-4fac-9c0c-b8379483db5c", "comment": "Malware payload (Mirai)", "value": "3c1a83a7ed7a1605a55a53cae850e69f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382100, "uuid": "8ee49005-0cbe-4650-9258-fdfb00a416f7", "comment": "Malware payload (Mirai)", "value": "9dddb1a1595a9dad2f74fe6f27de2763094de8db72a3016a23f9515790862a6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382100, "uuid": "8f3dfc6c-63d7-4367-91f3-d4e358bad6fe", "comment": "Malware payload (Mirai)", "value": "5e15ad0ce5515f2a3657b971f0d9689491fb7e71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382100, "uuid": "7a5e1d15-ba02-4470-b29c-f1d0ac8df7c4", "comment": "Malware payload (Mirai)", "value": "9b05585113ddebd6185eea4b1aa2673835d7ac8ed882162c7495a757e080d7f3374c86e140b06f411245fc68c94abb73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382100, "uuid": "f7f43617-8086-47b6-acfd-0dcdf8bdad3a", "value": "T1AB134CC59D43D8F5EC1505702863EBB29A77E57B1169EB86CBACD233EC02642B24728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382100, "uuid": "eb7f229f-21b8-4971-81dc-96d3045a2488", "value": "768:FDDotIftkZuBUGKfZNzSjg7MMdcgzzQBiI2EdURhT1kxufZp6T1yBg5:VDotIftyuBUGKezMdFjFRhTOx2ZU1y+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627382100, "uuid": "8aae3512-be11-44bc-92a1-ac34c9edff77", "value": 42032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627382100, "uuid": "7b1c93b1-f74e-4c25-9d3a-9b3dcf88daa2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382100, "uuid": "61d7b579-1bce-4485-a11b-c7b45ef32c17", "value": "3c1a83a7ed7a1605a55a53cae850e69f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee56e292-ef1c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627419310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627419310, "uuid": "b709f139-22bc-4e86-9c3d-a6b5ea9621b5", "comment": "Malware payload (AgentTesla)", "value": "ffe30c4ac40f0e43147b0ffe6ede3e3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627419310, "uuid": "c1aebb35-38cf-457f-87b9-552cfc83d4ba", "comment": "Malware payload (AgentTesla)", "value": "9f34067bfd42e0ddfff753c0e045a4a1df331d738ec6946ed35531f8cf33440b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627419310, "uuid": "35a0580d-eba5-43c1-b65d-09c1e482baa3", "comment": "Malware payload (AgentTesla)", "value": "bde322fd8135752b32f0301887e25295a08f2b44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627419310, "uuid": "bed774bc-ed18-4a91-9c82-453c75c98a6d", "comment": "Malware payload (AgentTesla)", "value": "1808810cb565de67a02340703b04fafe4cf9df569269720f6d7fb6cb7c3f49db6b19aa35ac46fccb13782103ec2f1d65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627419310, "uuid": "63e03498-828a-47c4-87ba-7aec365ca5a6", "value": "T100F4CE3804994A63C675A673C668E741FEF359927232DC09539BE68B1F1320329DEF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627419310, "uuid": "65d42500-88b4-4d93-8e9c-a54b04c5ea9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627419310, "uuid": "c25137fe-997b-4df7-b789-6f8cc757d33a", "value": "12288:rqZRCj+R1NCusiJrIL/st6cLA7RSAq+JdXOTNoRiRMYOodOrfUf2ntjjUS:eZtTIiugtZJ5od+TCRoJZdmUf2t/US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627419310, "uuid": "0d82446d-833a-4e44-9fd4-624a4b059265", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627419310, "uuid": "21bb3f48-0180-474c-b5b9-c26d9da01e41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627419310, "uuid": "289539b2-a444-432f-92e6-824178bd082c", "value": "new order 00041221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59661e3a-ef27-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627423784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423784, "uuid": "93c46eb2-4dfd-427a-8bc2-5e3535aa1066", "comment": "Malware payload", "value": "658b602138b5ab38b4c1b1f1e2e7445e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423784, "uuid": "321c838b-f50d-44f9-94c4-0ce66448ee28", "comment": "Malware payload", "value": "9fffb3894b008d5a54343ccf8395a47acfe953394fffe2c58550e444ff20ec47", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423784, "uuid": "66ff2edd-3ae8-4b53-8771-9d561442ff82", "comment": "Malware payload", "value": "768c72b07bd3f8242b92abf89687aa4ce35833ec", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423784, "uuid": "25e54c66-47d5-4875-a3c3-65e8adece869", "comment": "Malware payload", "value": "d40f72aa10e3fad08b2c66cdf166031f73ca9cf1e3957f47d50970819438775cd98d83680755177e76bf6f03436ce29b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423784, "uuid": "a0bdff39-5eb1-4acc-99c5-0e233431d63e", "value": "T190337B27F6F280B7C41842B90869F219FA3F5F3DD1225DE617E8D84C0DDA1D2AA5E14B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423784, "uuid": "98315213-01d3-45f0-a97d-c6f873484dd3", "value": "4dcfa8f4bd38e724c0bc69763daa4f0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423784, "uuid": "518ee02e-bcd1-4ebb-b75f-3e65793f76bb", "value": "768:GDAQKqG9MnydhSfPUGNMPV532vJZbmrXL3sR0sWkeqAJ9tXU1:G0GGe+kCPAJZyrXTsRPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627423784, "uuid": "8d0e433b-b573-485b-b79a-f7a8cee35245", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627423784, "uuid": "59340d67-df4b-49de-b602-6ca985cf5345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423784, "uuid": "fc67015a-1191-4e13-87c8-dc403e5d442d", "value": "9fffb3894b008d5a54343ccf8395a47acfe953394fffe2c58550e444ff20ec47.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929a55d0-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627365469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365469, "uuid": "600f6605-1d5b-42f9-af4b-d96657a0de72", "comment": "Malware payload", "value": "924f5e47a16597daf2dfbaf963036ac2", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365469, "uuid": "c680f2a2-2b48-43ae-ada6-1eac3530266c", "comment": "Malware payload", "value": "a05dbf61aac11cb2417a7466b053c082f7a4287f09b99246be1a93cf802f384a", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365469, "uuid": "404eeb13-c074-4e26-b230-5b695754b44c", "comment": "Malware payload", "value": "1bb1bc67d2e296f0247c2ccaae50e681c9b7affb", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365469, "uuid": "f1f17f75-a666-4177-a5a2-25a8206e8b51", "comment": "Malware payload", "value": "636c4c62f925e69d3d61cb08e04613eef34d578ddefaf0e9633efede871bb337be0e799f81078e9d8e899f614136e92f", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365469, "uuid": "e87e9cfe-2876-4442-af69-ef97313119a3", "value": "T102C12A757FA2F16AC50B487A88608086F42A957BD722A28F73E472C88F60DC4A707949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365469, "uuid": "5016beed-9cbc-4dee-95fe-5dc908c8f38a", "value": "96:N3joOreGtT74M6FspxOnsSmuZ1XieApmK8qqlip6J/9dj3s9UdMXf5Kj8R+P:N3Lh06xOnsz+ivYK3qlTds9c6hT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365469, "uuid": "a8ee840b-e180-4522-bb6c-bea4a3d48360", "value": 5907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365469, "uuid": "8b84ad20-550f-4818-bb54-499e862cf905", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365469, "uuid": "293718a0-a5f8-4732-96da-3f5d461f846a", "value": "Lea.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e79da6-ef09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627410778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410778, "uuid": "a72119f5-24bd-4095-a9c1-f10d412dd1ab", "comment": "Malware payload", "value": "136d3ff60c17a7e1d4e1b3c755e15d89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410778, "uuid": "1376fa5a-6918-41a5-9f2a-ddbba32e2318", "comment": "Malware payload", "value": "a0ee1d459912946e86b1695a16e4e5c288274959bdfb4d9e57cc83e473a3c10b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410778, "uuid": "da555878-17b3-4feb-9115-81327f175ca9", "comment": "Malware payload", "value": "88b8b2b70252e64bf5599bf0c2fcbca363c06c0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410778, "uuid": "df751864-a0a2-47a5-9007-7f6577260cf6", "comment": "Malware payload", "value": "3619a4d3293f22898d12286eefb1ca0ce097e5b29ff1d618fd5c0c375fc8de3ed9b8d326ea44c07dff544fdb1b423e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410778, "uuid": "7515e77e-38df-459c-8fa6-626474b3a6d1", "value": "T143E4F068732BA348DD34C7F91C7AD5E267AEA02A666DC63C1E84C13DB9737BC5AC0411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410778, "uuid": "bfdc10d2-9df9-415a-9ea8-3d50ad023edc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410778, "uuid": "795f2738-84d3-4e27-8916-3ef61f3ffb0c", "value": "12288:uT4yvUIZbV9sdU0zs5mAsYwNVS68W7Zwk9CWviEH8KKwjAXRo:WnvDB9n5mAsYwNH8cOk9CWaEcfwjA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627410778, "uuid": "ee140e5f-bae4-47f6-b6e1-bdc7fb4168ee", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627410778, "uuid": "e939ca73-9544-4b47-bac3-5c3012b66bd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410778, "uuid": "76b8335e-26bb-47b6-bb24-cac1a9b39b5e", "value": "REQUEST FOR QUOTE FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f7229b-eef3-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627401572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401572, "uuid": "5efa62b5-3752-41ea-ab7e-c59cf550fd16", "comment": "Malware payload (Loki)", "value": "968b17cbf61802592fde392143660add", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401572, "uuid": "3ab038dc-c57a-4693-a82b-7d7935d68f90", "comment": "Malware payload (Loki)", "value": "a136e7979c03ad9e689caf926a8f851a26e52e53e27d950d5d0c28dadb2bb353", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401572, "uuid": "29dac28f-4b9e-4f87-ba41-b72f11d785da", "comment": "Malware payload (Loki)", "value": "5ebfaa463908ff18aaaddeb618fa790d01836dcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401572, "uuid": "f769f376-d423-4ea8-8ab3-4676586d0179", "comment": "Malware payload (Loki)", "value": "0871e0a033918cb33709d49e07a10da74a5f46c0d4e3f3bb0b10075a6cad6d58de714342469e8e6b5b3bee10edb43249", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401572, "uuid": "eaf5b78d-280e-4e2c-8e6f-5e6d2cc3c574", "value": "T1BB648D30BB51C035E5B212FC49BA93BCA93A3A716B3450CB53E12AEF56346E1AC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401572, "uuid": "9ffdda9c-d1b4-4d83-bac7-e48b8746f59d", "value": "800102d28cf35c665bee356e0e434ad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401572, "uuid": "6a5e10e7-dfcf-49f6-a05f-8bb0352ed2f0", "value": "6144:AOgMu7fF7rVKqljeMUvffvRNWzDAuqH5rrp0JrT+tdSxde9jIOqT:pUfF//ljnU/vRwA/HdqJ/+ex8ZIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401572, "uuid": "fa72f322-a441-4d80-bf8b-936659ac8618", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401572, "uuid": "d26743c8-4ddd-4571-941a-b9dbba8266f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401572, "uuid": "f9815348-c415-4c83-953f-95fb96736c23", "value": "968b17cbf61802592fde392143660add", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af0f381-eed3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627387682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627387682, "uuid": "75a00c49-0654-4ace-8db3-0266d2619319", "comment": "Malware payload (AgentTesla)", "value": "0f4064452757c9830209d116580adc54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627387682, "uuid": "762d6bcc-0c7b-41bb-a078-c39c61b4ea60", "comment": "Malware payload (AgentTesla)", "value": "a1520040a9646ea2582d5b6ec7ddb720de8195473675a768a60659ec277101dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627387682, "uuid": "a6f98951-f952-4b5e-b1e7-1d7afcd73098", "comment": "Malware payload (AgentTesla)", "value": "9fad72530e98734aa913b36a69b963a91eefac13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627387682, "uuid": "b3f43e05-f75d-4f85-b614-a8f3a4649e09", "comment": "Malware payload (AgentTesla)", "value": "95239a0764ffea7ed9a5becc0c66b9e3ecb052146ea60b0b1eaeae0583081c5d247a7dbbe8733263821c2e70bb32320d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627387682, "uuid": "abb31790-19b3-42be-97bc-d39addaef321", "value": "T1DEF4CFE4153C7B0FF0AF1BBE907040229BF0509BC969DBE4FF7215E6AF162972152686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627387682, "uuid": "d976f31d-752f-45ff-8d83-f9fd96d7a386", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627387682, "uuid": "426826de-0e67-4be1-930c-8ec6a3ca4753", "value": "12288:pO2PU9CPU9FcT9FBgb9OsBgo0q4wMy9wkfh8GqwWatS1OFThENCaQvwK20Sf:pOJb9OsBgo0q4wMy98G7WaSO/ENNYwDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627387682, "uuid": "7377b969-155c-43d4-9b4c-816a3389d4dc", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627387682, "uuid": "a10c501c-e4d4-4bb6-93ae-5039d0396162", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627387682, "uuid": "71215999-ef55-4ee1-b5dd-c19ebd912969", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017e4cc3-ef2d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627426214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426214, "uuid": "4899faa3-7575-442e-a434-736aec970efb", "comment": "Malware payload", "value": "e8c389c73ce6af5bae634cb344049ea4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426214, "uuid": "d482bce0-67d8-4e97-9fec-7ab839e3f1c6", "comment": "Malware payload", "value": "a1affc43f638758a952ce5b6ab783f304ded995bce879dd603cb2adee7e0aee6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426214, "uuid": "55a13f0f-b7ee-4e85-a01a-102b008fd64c", "comment": "Malware payload", "value": "1c66670409db54458739762244364f4a4465a76b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426214, "uuid": "a2a31323-6da4-433d-9054-0435f956f790", "comment": "Malware payload", "value": "2c62da1e540622a71e902c595175a710375b00f0b23b60fdbcc15ebde54d596e0c1f6dad66f981fbb433c629ab90c370", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426214, "uuid": "74fa71e1-1b37-4ddf-b452-d46511d6083e", "value": "T1F7B35ACD6EA209B1CDDECDF186E12B1C0731EE5F2D03D6A9278416C82F975A45D0EE92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426214, "uuid": "3e4f1e83-9932-4b15-9638-f6c36b7b6423", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426214, "uuid": "3d68f124-eeaf-4734-b715-1f855a25a1a0", "value": "3072:LztWnLnrXUVEUu9n5kyjjmCIhDUm1YhS0x1WBmVlDn9t9vBFKNqSd99D7:LzEnLnrXUVfuBCyjj3IhDUm1YcmZVrtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627426214, "uuid": "c9020b63-f4b6-424a-a84d-fb44e926ed53", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627426214, "uuid": "f675ca81-3cc7-4253-865a-6e0fe1846517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426214, "uuid": "6893d3f8-7574-4326-8494-813e90d44bc5", "value": "02_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70d0007-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627366443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366443, "uuid": "dee0a7f1-5bf0-447e-8483-d6b794adb436", "comment": "Malware payload (Formbook)", "value": "4532c4e5fb5e5586ca85073be38d2671", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366443, "uuid": "f04fc0dc-3d03-4a1e-b069-bc25c8943c8e", "comment": "Malware payload (Formbook)", "value": "a3855556dff3052de6a95a3684700f9bd6b9997b1db3eb427617325cc1020c3e", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366443, "uuid": "5385b367-40ba-4674-8f18-44a2574ebd40", "comment": "Malware payload (Formbook)", "value": "84e80761996443829f1c34dd0194a7859399266e", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366443, "uuid": "bea805cc-dced-4af8-8492-b5f24065e1fa", "comment": "Malware payload (Formbook)", "value": "dc1e35e9aea00168b916297dfd57dd492527c43fa86a833652733b13c8ba1b2bb48a86022a4236391093a51cffb200fa", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366443, "uuid": "aea3b75e-2db8-4577-9970-942161575276", "value": "T1EFB42382242AAD1B821B8CDA61CA346D477C3DBB9ADEF6F097500DB345CEC549D2F076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366443, "uuid": "9aa6f497-c36a-4773-a33a-f0a84a5b6d9b", "value": "12288:2OdXi1OPT45ulcaIBNZkDLn0fgf5pPMpJJ7FJPOv3+1iZ/7V+CjVt:2e0Ob5ipcM1Ov3+18Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366443, "uuid": "998b5a57-e754-4f7b-b9f0-51cadc21ceda", "value": 514277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366443, "uuid": "d2a65a5d-e749-4567-98f8-cc85b2948e8a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366443, "uuid": "71d9e1cd-b640-4e31-a30c-adbbde1cbe9d", "value": "SWIFT.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3db7b6-ee7a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627349751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349751, "uuid": "f7d5e682-2398-42d6-b232-6d38c46a036b", "comment": "Malware payload", "value": "36efb3390df7e6ecc5289f72cdf59d82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349751, "uuid": "36bacc3f-5e31-48da-a11f-cee005237cf0", "comment": "Malware payload", "value": "a42e903ae820f28980e819453ce24adcb66832cb474b993a288518562092fb68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349751, "uuid": "4f8e9c94-ecf9-48ea-9a90-2416ec9d0e9a", "comment": "Malware payload", "value": "82232d26e463c35101d6138077fde167c35a5b11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349751, "uuid": "3e615208-1610-4a2f-90f9-542cf6327960", "comment": "Malware payload", "value": "1ef5f5c889bab314dfad717a43e6943aae557a647f6e4383b19445ea6b461a749ed5e3b2df464b15a7430e881746f144", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349751, "uuid": "0b5c4294-cf4d-4675-8aa5-702f1b4655e6", "value": "T14055AE15F764C0B2C147417E8856C76AE772B8250B748BCBA7A04F6E9F233D1AD3A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349751, "uuid": "6e3837d5-86a8-4968-9597-c811f12d9e5d", "value": "97684ed2b4bb5eb7f373577c0891222e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349751, "uuid": "18238b9b-6c3f-4eaa-be60-df1bbb582018", "value": "24576:UZUwXfHfdrWqVn6tnFE2A8ZF6Qm+pKVG29fcwDLMQG+Z2XlR:Cf/RCGmdpKb9fc1q2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627349751, "uuid": "c8a42a5e-1359-46fc-87f7-0f91f398b198", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627349751, "uuid": "0ab23a63-075e-4866-9ec1-f264f99a0bcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349751, "uuid": "6e5d9ea5-adf0-422d-b237-5b30b6e72e27", "value": "36efb3390df7e6ecc5289f72cdf59d82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba34c0a1-ee81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352650, "uuid": "2dcab25e-f999-4bad-ad01-2e8c1f983bc8", "comment": "Malware payload (Mirai)", "value": "2e4dfc92039379c70ae374d6824136b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352650, "uuid": "037332a6-511c-4a96-a609-1efe51f216bf", "comment": "Malware payload (Mirai)", "value": "a44700c49cd7844c7ed54115106bca85c4c658211637f07f214cbe1a1a6acf51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352650, "uuid": "3cdd4a67-0dcc-4b99-94f0-d49219ea559a", "comment": "Malware payload (Mirai)", "value": "42484e56cb6a4f4173580f85fcba608f7c7f8435", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352650, "uuid": "9d9208bb-94a1-4df1-a283-e6e41f62fb69", "comment": "Malware payload (Mirai)", "value": "7cfb4d580e5c8c4b6b1540dea53803fc3c02a7c3b1ad721b69ffea0f4afa1ba1a691f87e276f86e552b5aa32d8b827f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352650, "uuid": "30027f67-1a29-436b-91ae-c83207fcb317", "value": "T103D2D16866040CCAFA1745707FF90F951ED80F56A407AD80A741DEEBEE456BC61C77C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352650, "uuid": "4281d119-599b-42fe-9ee5-9a9a5721127d", "value": "768:B5XPCGN/0ghCqky3TxEn410QtVTSpiXxsFReQJgGlzDpbuR1JL:TXPd0g24akVScSPhVJup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352650, "uuid": "abbef199-4bac-4925-9f11-b61be0a974ca", "value": 30676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352650, "uuid": "642f85ed-639d-45b2-99ec-dcc8f1954595", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352650, "uuid": "47a3b8a9-aadf-42b2-8269-0842f0f4d0cc", "value": "2e4dfc92039379c70ae374d6824136b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb55b31b-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627400756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400756, "uuid": "60a76390-f34b-46d5-9e23-edf110272d6f", "comment": "Malware payload (Loki)", "value": "2b0b22566bf88c5d90484de67f5dd2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400756, "uuid": "7647723b-4741-40a8-af6b-cadf7a7db6f5", "comment": "Malware payload (Loki)", "value": "a4496233ba3b2c6ec5f8f1d591cf45839d3be94ae0517c5a83aab9586de103c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400756, "uuid": "0f54aecf-bb5b-4317-98e8-60c15e79f96f", "comment": "Malware payload (Loki)", "value": "97e4f71da6fc0a56a4b4a384618096274646df12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400756, "uuid": "45354c86-a7b9-416f-93f5-cf497a6332b2", "comment": "Malware payload (Loki)", "value": "782d22b9a3d9424cd5357d3e5b0e3ef2e466a2dbd9399534fcede2e38da870e3936e6f524b4ac81eb58c9a4291bf1b07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400756, "uuid": "00fcdd43-6d6c-4a8c-84d2-0603163b376e", "value": "T185D4ADE516397F1FF0AF0B7D907140625BF090DBCA6ACBE5FF7200EAAF252965051286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400756, "uuid": "a2c60ae9-82ba-42e1-b152-ac4edf1ffc9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400756, "uuid": "faf33bcc-1392-4c54-8df3-050cb9534924", "value": "12288:wsIPU9vPU9i6d+glMSjvdOsBgo0q4wMPaKLVXkAsnLJHjjezuShI4/ig9tvHWUMC:ws8jvdOsBgo0q4wMPaKLd4n96ThL/iwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400756, "uuid": "33da8851-9fc1-4ccb-a8c1-a6ce3faa66f8", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400756, "uuid": "ad454879-4a5f-42af-a4a9-23967c18dd74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400756, "uuid": "a582dba4-d6d1-41db-8d3a-5ffe11288d67", "value": "2b0b22566bf88c5d90484de67f5dd2fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4289da6d-eede-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627392393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392393, "uuid": "60303428-649f-480f-be1e-a147db9a88af", "comment": "Malware payload", "value": "b37aa42e579b64a3c51caa366c0f94ef", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392393, "uuid": "c3e880fb-156b-4daf-ad59-410ef61d9a25", "comment": "Malware payload", "value": "a47e8b49852b6a0b3a074384a859a4816e0e46d56e138abf50f19b4df9128142", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392393, "uuid": "4c3d46aa-897f-4690-964c-bc1b5d95005f", "comment": "Malware payload", "value": "524243382dbb6e9e795059d6eacab0f2446b8b20", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627392393, "uuid": "9ed85294-533b-4a10-b381-deddf73861bf", "comment": "Malware payload", "value": "031fbd69f1ca74be37ee6bc7a306c2af6a4037600c5c4250a18c5c7a3ab22b38395dddc7da303f0828a47fd0ee7bd0c1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392393, "uuid": "c5db70e3-201c-4c22-88ed-ab249ac85e88", "value": "T1B022F91536EA185FB1A34BCE99C4A4DBFD9FF2263B3A3656216107874741E00DE107AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392393, "uuid": "6e5f2963-7357-480f-adeb-766a305fcce0", "value": "192:kqIqIq6rFeM010tBhtIhqU5k8H+1QW4bgJX:kq2q6rFnt3tI47wbEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627392393, "uuid": "2f21e0c3-c95e-42dd-95e3-6a87413389fa", "value": 10082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627392393, "uuid": "a8f26050-3a2f-4e03-909d-2cdbf7e58870", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627392393, "uuid": "34545ec6-0e6b-4d2e-8ccf-99e6af96e527", "value": "45678.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b63cfd-eef2-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1627400875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400875, "uuid": "768369e3-7743-40ad-a90a-3eef6af7a645", "comment": "Malware payload (CryptBot)", "value": "af12a5b1fb40fb31e4f8979b0a4cb42c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400875, "uuid": "951ea47a-d8b1-420d-83ba-3f47e7d97240", "comment": "Malware payload (CryptBot)", "value": "a4c1611cb53460b6e745cc05101f83a834d66d78462fff9b190cff9727784700", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400875, "uuid": "d3a99073-283f-4e9a-ba15-3c22515056c0", "comment": "Malware payload (CryptBot)", "value": "a1ff752ec748ca0dae13b861b8bbc3da61fc7c8c", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400875, "uuid": "1497e59b-a0f3-493e-97ce-65e6845ac59d", "comment": "Malware payload (CryptBot)", "value": "d8fa4fae0aad36b980eb66f0aab7dd20d230d30f2bc69eff96946f37b1a4fd355672f64440e706c34c1a3a453070c21d", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400875, "uuid": "e49303fc-0bc3-4a7c-82f9-ffb89dd6fd8d", "value": "T160F4F1207AA0C039F2F712F44575A3BDA53ABEB19B3450CF12E52AEA56346E5EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400875, "uuid": "12c49c56-a1c9-4821-8374-3bdfb447acba", "value": "fbe702755e2fb4e20a84826fa92fd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400875, "uuid": "f0bc667d-1acc-4e74-9189-9e0c91cd0eb4", "value": "12288:H2IovgjeluRYwmJewARd/aBscxvzSbTw3IYlCsETpouGeOZ6fhVTcQjTW:AgjelJfAyscM/gCsETpoveOuhVTNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400875, "uuid": "5257a57c-d4ef-4f9e-bdac-441ae2c6d33a", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400875, "uuid": "276eb75c-7698-4e49-a789-cd37f004dc50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400875, "uuid": "932665a0-e347-4967-bc04-bfac31ae143e", "value": "af12a5b1fb40fb31e4f8979b0a4cb42c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab61a893-ee81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352625, "uuid": "598a8e45-0eb7-4501-a49a-2cbba1570703", "comment": "Malware payload (Mirai)", "value": "6fe1dfd05890bec00d214def29f65756", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352625, "uuid": "94d18643-7496-40a7-8c4f-f5d417075b91", "comment": "Malware payload (Mirai)", "value": "a533e8d8de04adb5ad1e01c6d9f7fbcd2d436401bc5533f288d61a325f44108e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352625, "uuid": "f98af383-3fb4-4b98-8d4d-ede9eed2cd77", "comment": "Malware payload (Mirai)", "value": "bbffffe4ef2e75b314476432dcfa57a5c38bb46c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352625, "uuid": "f27698d6-db9e-4ead-9632-4d5f1de19725", "comment": "Malware payload (Mirai)", "value": "28cb3404931f006fce661ae0ed592bdc3357fec441f6dfc6a550ea76ecb826b68ab95a743b746f57ab9bd55824c47638", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352625, "uuid": "86704b5a-5a4c-40d5-956f-8ba8c4527403", "value": "T16CE2D09DE9D8B887C58C7E3884AD0B91E895B1C073CE4788A6124983F4A17CDF9CD76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352625, "uuid": "8c885546-9433-4565-8e2e-6185c220ded8", "value": "768:bchVzSffWnLLCCUmHN7j0Uz5+KsRKEs63RE6WQH:bcjSGLGeN8UgKm3/3We", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352625, "uuid": "a93dc5b4-22fd-4ba9-9a2d-79d862184e6f", "value": 31664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352625, "uuid": "dd232df8-b37c-4f96-9dbf-cba868adcaa1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352625, "uuid": "007b5ee2-1889-4938-b5c7-b626759efa93", "value": "6fe1dfd05890bec00d214def29f65756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8541ebb6-eef5-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627402383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402383, "uuid": "e9c16140-3573-470c-9ba6-f1ad7e90c215", "comment": "Malware payload (Loki)", "value": "07c01497b1a48bd763519c1b2561ab2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402383, "uuid": "69f4d19f-851a-41eb-8959-922a798e1352", "comment": "Malware payload (Loki)", "value": "a60e97778614ab28c9e6acf9a2a76e8f42c09372af1a9e5e6802018e3cee2829", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402383, "uuid": "ee41d323-06ef-43f7-abd8-e9c0be04cf5f", "comment": "Malware payload (Loki)", "value": "7cd72784c6a4e251068a43cba935ebc8a1531c84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402383, "uuid": "05ca1f8c-d0dd-4a18-942a-c199ac7f370d", "comment": "Malware payload (Loki)", "value": "4e5637eaa7af0656f2206eb0237fb105e17623c2e0c6fdf99cc79c539c71bed3193c94ac879821893d4f13fcba82033f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402383, "uuid": "ca257c8f-7315-4059-87c3-8007f579d3bd", "value": "T16644E141831ED679D05242F0522486B74CB6B4F2371F51EBDFC4AA29B4BAED29C2374B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402383, "uuid": "d8479b60-ead1-4a1a-99f8-4d17f2f4d487", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402383, "uuid": "ff7f1931-c743-4982-b62a-fc4c9ad1bc48", "value": "6144:Zd53TvpHeIl02oaK6V5KdAJEq2n+FBidX6a2258QqG5pa5668Hnz8+4TFPzsrI:Zd53TvpHeIl02ouKO5TiF1Y8paYjHz8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402383, "uuid": "00d2dd49-d082-4864-80c5-a747d1963dd9", "value": 256849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402383, "uuid": "cbc368e8-21ea-4887-ab57-a180f8515d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402383, "uuid": "2f47d596-e8ec-42f5-a483-03f96cd341b8", "value": "07c01497b1a48bd763519c1b2561ab2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becc1382-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627366402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366402, "uuid": "ca22f447-ddb9-4b73-b0fc-0a3d98366b9c", "comment": "Malware payload (Formbook)", "value": "9dcf1ee2b34aed3acd5d85fe02ab9f74", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366402, "uuid": "db49fa1d-fe5a-4ee3-81c0-c538a0e4c21c", "comment": "Malware payload (Formbook)", "value": "a688a85e74de4042e43a2fd30cf7072c082170b19f86f44df5895f79bacab8b8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366402, "uuid": "e4eff93f-b00b-496b-a4e6-94ee34303016", "comment": "Malware payload (Formbook)", "value": "230fc13bbeb2d24c47647e3de2240e765f072d32", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366402, "uuid": "82a9d9eb-337a-4e22-a69c-064c2f499ee8", "comment": "Malware payload (Formbook)", "value": "6db10ff015ed53785715ed0efd9d09c71ad6bc7f043686937b1d0ac10ffb502773632ffc91a69c70825dfcc757e61e14", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366402, "uuid": "00c9a5cc-8457-4210-9ea8-89fc66d7a780", "value": "T1404512F3A855CFA9FCEE7376804096CB3E1C7C0196CE590BB2163625A1B03A4D5469AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366402, "uuid": "14a90ca1-4d55-4e89-8c4d-601b360e81bc", "value": "24576:+iaUhlRAu3GdgXgtq+2ti41BYEWgRB2QK1uqA:hNXmkGyfvBxbsQK1TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366402, "uuid": "0123993c-a9fc-41e8-ba7e-35780f0da917", "value": 1250304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366402, "uuid": "244ab4a3-bb60-476c-9fb9-bcd40d9fadba", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366402, "uuid": "f8729f82-452a-4fa5-bd42-10c254273ed9", "value": "CTM-Breakdown-Request.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35765ee4-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372184, "uuid": "de471ab5-a340-4945-bfde-c3367f6a2998", "comment": "Malware payload", "value": "cdc3d6e1f6e355271d47711b561d5a96", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372184, "uuid": "9804285b-472c-4cf8-bff4-9941373fc341", "comment": "Malware payload", "value": "a6b6080b4146a109d9c2bbb3e3bf4dd511b37deae0c3f333922e3e44a91ec74f", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372184, "uuid": "46b461bf-4693-4c58-be7d-09e1a3f9be39", "comment": "Malware payload", "value": "2e73dc71b3995db85f866e1d014a8f2feb1894fd", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372184, "uuid": "2b5ce870-3f73-44c0-b7fb-c513ec673bb5", "comment": "Malware payload", "value": "c56a03dee0d5d9bc464d50dcd980333e1eeadcb0a91dd29e5eba66ef65e9c7f3acd343b9e4888f2b15111d0ac6642a7e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372184, "uuid": "4e633b64-c842-48dd-b4ef-867dd3fedacd", "value": "T1904512A8ED5CDFABE2C20A724C7F50641597AC217A09C1BFE379B61C54FC3926782E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372184, "uuid": "f3ba7824-235d-404e-bfbd-1c8f79888b37", "value": "24576:XMOyHTj0V8AN+EDue4/McKIDrE/7lBlkaXVOM+naR8q+/siVXg/SqKbF:XDyHTjZa+PMuDw3k+VOMQaRo//VXgxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372184, "uuid": "db6a8a3f-38a0-4e90-a88b-da3142e8df4d", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372184, "uuid": "ffb467b9-f3ab-4490-a46d-075bcbeb0585", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372184, "uuid": "377b1469-b79d-4292-80fb-5f2922706576", "value": "AGREEMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd122e5-eee5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627395717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395717, "uuid": "eab01084-322d-4f78-8748-12f684907e3a", "comment": "Malware payload", "value": "9101cb7d395507cb7e67cbab4e6abb1a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395717, "uuid": "911c8d65-8abd-4f18-9641-67654522e317", "comment": "Malware payload", "value": "a7c4e1af232131fcab153968f3affced2544bcdd1e928e9bbefe7b05a3122afb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395717, "uuid": "1bd7d1b7-de10-44d5-9141-fb0c1bf78f21", "comment": "Malware payload", "value": "470f8dfb876921d77ff7ac02bdd29c12054b3c77", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395717, "uuid": "c6a6e6d5-a4d8-49d6-9014-d7d10b4a4fa1", "comment": "Malware payload", "value": "d92b887af5cfdb6bb635ef246c840ef27cb32d5a40f004cd206be4577aa4507ee4659443a31e5301537a90ae5b43e3fc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395717, "uuid": "97c33609-5934-45d7-9f84-8b00803d82d5", "value": "T1EC34FBE4688F48B2D2499C5E6494B145AE74FEE334C5887223AFD434DF5ABF29EC4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395717, "uuid": "c090b8fe-f1fd-4a14-888e-f59353ecaeb9", "value": "1536:iqW7qA4b64pVTDuhrNnlwrnEYo9V2A0RowKxvVCpBdzFz76mAg5eeVhMDw5wfLT:iqW7qA4b64pwvrgBdzFtr5RDAw5wfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627395717, "uuid": "a4796bb0-c747-4bc2-bec9-ab917009268c", "value": 234652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627395717, "uuid": "6dc43e61-0c15-4106-bbe3-4b111f9e398f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395717, "uuid": "5c4d5738-7b6e-49d1-b86f-5b908ffe9ec4", "value": "REVISED P.O 200030233.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914236df-ef27-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627423878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423878, "uuid": "e361da4d-fd0a-4918-9aea-447b2ef51441", "comment": "Malware payload", "value": "bb1c7759e5f45dd72463313c8b666bb3", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423878, "uuid": "6cc21ed0-881c-4b6f-bdfa-e44bd52db7e8", "comment": "Malware payload", "value": "a9cbce007a7467ba1394eed32b9c1774ad09a9a9fb74eb2ccc584749273fac01", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423878, "uuid": "f5ec436b-dbb3-4316-b889-57fe30878f58", "comment": "Malware payload", "value": "8c9144eda5f701a5aa77e859038446432d8848d3", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627423878, "uuid": "8f43d0a3-de8d-456c-ae6f-24e765e535a1", "comment": "Malware payload", "value": "64ba98cf39e8ede16398cf8484c71c17155198c23f05d967fd552edc7b7342b7d839da0c6bab446651ad745b6f7df09b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "Thor Variant", "colour": "#B548CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423878, "uuid": "78076dbc-2616-4cc1-8a69-857a0ba06d79", "value": "T13C637D2177D594B0E5FF063518B48A41267E7E215EF68C6B3F84128E8A702D0AF79F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423878, "uuid": "c69fcfa3-6812-4737-a401-9c8921fa12cc", "value": "04806a1eaf4e8de6f0935e3aabe9b8bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423878, "uuid": "f5e088a8-857c-4d9f-aade-9a499862d12b", "value": "1536:J4Hd4iaPI1/zhAP6YtnogaDc8zvsWjcdSG8a:dzw1/zeMzQSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627423878, "uuid": "31013484-e4af-49a3-925c-ee09dd59538f", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627423878, "uuid": "3b75dc71-55b6-4d1f-874d-13e1898cbaeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627423878, "uuid": "f8bcbfe8-b5c2-4932-9746-f7043f590361", "value": "a9cbce007a7467ba1394eed32b9c1774ad09a9a9fb74eb2ccc584749273fac01.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782ae701-eef5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402361, "uuid": "3dc4b7c8-d4eb-44b0-9f77-30b50ade4233", "comment": "Malware payload", "value": "ea4d96f213ca97ecc5dcbffe408ff2bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402361, "uuid": "cd194e02-6def-4307-81a1-9e07a46c92a8", "comment": "Malware payload", "value": "aa49a468dd184ec1ee4b126823e7c3dec0539e75b0736b6f2a24116fc33badb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402361, "uuid": "ca55e5ec-568a-4122-9508-17d8054ed79e", "comment": "Malware payload", "value": "3b3cbeb4060970f0d349e6ec37a20cf1285800b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402361, "uuid": "e1581441-7b70-46ac-ac2d-b866ac0b4873", "comment": "Malware payload", "value": "70b5f543c996169eb37652625a8d7f5582a0d829b0dbb5ca9ce0ab5a241209ae7b8727cd341865f987263f1da62c125e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402361, "uuid": "efbad13a-34b8-4b21-b1ad-5cdfdbd6efdf", "value": "T119E4BDF83539375FF49384BE54B45CA6696010FACA2EC752F33341AAEF1D89B9900693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402361, "uuid": "b6d72906-f6bc-40c7-886c-908726d7195a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402361, "uuid": "84a20e1c-a304-4c70-b75f-550f6b3b343f", "value": "12288:Wp2MEnrRdnbe/QUyDd0A2tboT3sHdYcR9dbJKcFrvNYQ28FKhm84B7mo5oFCEkv:WA/Fhi/QBqAIbW8KGkwj+K7mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402361, "uuid": "eec9d75f-0d5f-4aa2-ad79-4ab823a48532", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402361, "uuid": "1a8663a5-e3cd-448d-8fe7-48a167c3b185", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402361, "uuid": "20487055-8740-4843-a7b8-ec17ad2a7d28", "value": "ea4d96f213ca97ecc5dcbffe408ff2bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f1c556-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402122, "uuid": "fc0e7011-b5c5-4d89-95f0-8a7215735ad4", "comment": "Malware payload", "value": "974002210e2653b68b75fa846d44e319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402122, "uuid": "13f4a3aa-60e3-4c0a-a425-ecc6c28791d6", "comment": "Malware payload", "value": "ab10d3d15cbf2318c1640d06d041e68c405cbbb217f949ad8bdbce56252dc677", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402122, "uuid": "0b8addb6-b043-4be0-91b0-d601564e312d", "comment": "Malware payload", "value": "273e4e1b79f8e21756be7a40754982dcefc44188", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402122, "uuid": "877e6f0c-8690-4172-a55a-4ce922da39c1", "comment": "Malware payload", "value": "9fe6b19a79fe61016f49bc042fa2d3ef100f379659334a550dff119a00a331930913c2f34aedaadf3647071569c9919a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402122, "uuid": "2278d79f-f6c9-4d62-8d1d-316293090f6c", "value": "T1EAF2E159A53BBCA1EBE9C634CEE936D67F728C07F042C292A2265B016D1541B7318B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402122, "uuid": "c9138f8c-b586-47c6-ac05-a3bb547ca89e", "value": "768:pb+S3FhHkQ1+7ZQuHjL4hQ+aF+YODQBXzjGHtL214uVcqgw02NWXr:pb+UF17+qyjL4hJDQBvGNLm4u+qgw06U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402122, "uuid": "32d93ff0-f08e-47e5-b9dd-3c620b51f552", "value": 36052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402122, "uuid": "e0d463b9-3246-470d-b6da-3f46c3cf1e22", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402122, "uuid": "f5f52e23-e4de-486a-8314-bb69b62262f5", "value": "974002210e2653b68b75fa846d44e319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0138704-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402133, "uuid": "0dbca5f2-8d14-4218-bd3b-0eb54489422a", "comment": "Malware payload", "value": "591ae21c18320e97e8f950a1d7a826df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402133, "uuid": "72e7fc73-a94c-4c6d-ae27-8955d56b0faf", "comment": "Malware payload", "value": "ab616e9a4296ed9c38e35170d214011d00cf99e8061746733bbb9adce2b482ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402133, "uuid": "688a41ee-cc90-4e04-94db-e3e6e06aca37", "comment": "Malware payload", "value": "9fea04965cf2a96ab8dddc7990157a576cfdc012", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402133, "uuid": "db3d74c2-32e4-47ae-8c4f-28241c046dad", "comment": "Malware payload", "value": "f1407b5c0ab9dde6eee4d90e991407d2e73d24ecdfe8254385557fad587d19edc6b7e8ff21941367fec0a1d72126a831", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402133, "uuid": "36583a42-62bf-40df-942c-028c3474dd17", "value": "T1D103F200650B7D71CB60947AAA128107579E4B78A171FFABC28C8F3989C7285F378C6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402133, "uuid": "bc29cf3d-ff86-4889-871b-edf39d5a110b", "value": "768:byvfY6RLFUWAo0ya/zPI6USCk3/f/KxCRFNXs5q3U7jm:GRL+vo0yarPIfQvKCNG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402133, "uuid": "87d7dd08-d8d3-4321-b0e9-6737d7b72561", "value": 40304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402133, "uuid": "b954fbf3-8a2a-4991-a443-4d4ed5d6c556", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402133, "uuid": "0ab43f17-4137-4001-95e1-de27d6ffa3c6", "value": "591ae21c18320e97e8f950a1d7a826df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21124ecd-eef2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627400926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400926, "uuid": "73c3aaab-51c1-4b5a-a7f0-3136d1a39f51", "comment": "Malware payload", "value": "e1d4a036b94386f0d33843622fab1bad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400926, "uuid": "9ffb0d84-1ae2-4e88-b0b5-ce00f9584075", "comment": "Malware payload", "value": "ab7e2f3d96941792e0be9139f29d555c350123f8be701c6cd0f132c98f351407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400926, "uuid": "9e2875d7-e3dd-47b7-aa40-d56ed9851c82", "comment": "Malware payload", "value": "ea5e11f919586f87d34a8039afb9308b93a07f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400926, "uuid": "ebe1e60a-8d5a-476c-8925-47255d05013c", "comment": "Malware payload", "value": "f6174162240a3da8379370e2aae4a933b84ca3d80cb7c09f289e18e8b34c10749c93cb5951b28325c7d41b0be42b8d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400926, "uuid": "60bc0c44-6ce7-4590-a4ac-2dc1b0d7ee8e", "value": "T17395E0B1051DEF22F8B706BD7872564442B48D46C96BCB68EE73329BCA70FC23456B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400926, "uuid": "375363ba-f13a-4f15-8af3-3ab0179dee93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400926, "uuid": "5e2d6bf5-b797-46aa-b62e-31c8500b6425", "value": "49152:fhZUoHMjmCm6Ud+zyXc6dnS3vt05IVqCVhT6DDt:fhZUosjmCmN+mRnI+m6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400926, "uuid": "d7890fa6-f416-476a-8b1d-65d90f6fe43d", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400926, "uuid": "500e4b31-54e8-4051-8890-f79e678dfc9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400926, "uuid": "b35cd28d-3d4f-46ab-9129-f8e5e61b8ed8", "value": "e1d4a036b94386f0d33843622fab1bad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee80d2e-ee81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352631, "uuid": "337e56fe-9f84-4232-bb30-98fa7c16197f", "comment": "Malware payload (Mirai)", "value": "0344e92f858b16559595056e1c02f477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352631, "uuid": "ef8a48b9-bf8b-41ad-99e1-460170a39b96", "comment": "Malware payload (Mirai)", "value": "ad07e62cf90065fc344b52b6c33be9fd54dc8f02ca0d9d505fd3d945e2d8cc1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352631, "uuid": "17c3e7a0-e584-4dd1-81ca-dd2a061d5225", "comment": "Malware payload (Mirai)", "value": "80c6469d919b203e55b5ff2f5192942facc09133", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352631, "uuid": "3ef62c56-1380-4f51-8aea-db7452a31369", "comment": "Malware payload (Mirai)", "value": "05f9707b8c4015553e41840b149092048a458e9320fbd44d7e894644dc27363b0d9fa652c03de9a7fbed88c2345e5f4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352631, "uuid": "e155db5b-0563-4173-a0ec-f3c4550a2c0b", "value": "T110D2D0C4502BC067F20802BEF1391E8D0D411E25EBE94355B5BA96E1D7BB8F92DB4AB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352631, "uuid": "25aaf2fb-e115-4788-b997-464700b42323", "value": "768:DM4lFPMdh3EH8k9RUwrn4LwK88F7/24W8OLae6MmkZaH0/:wIFEEH8kdrf8pQ8Ux6EW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352631, "uuid": "62a17ddb-9016-4deb-924a-25f85b4513af", "value": 28920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352631, "uuid": "d85186a1-7993-4f3a-9be9-bb7cca97d8a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352631, "uuid": "61c0b1c8-a2c3-4fe1-ab15-39c5f5371d0d", "value": "0344e92f858b16559595056e1c02f477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4974547b-eeb1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627373077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373077, "uuid": "9fc63427-b4b4-4a47-af95-2a06e435e4ee", "comment": "Malware payload", "value": "543b5073292e18f6d86747af0dfb751a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373077, "uuid": "649b5f17-c8fa-4c33-9961-c4d91bcb6a05", "comment": "Malware payload", "value": "ad50d644539f25d89bf06bd8d5f5fcd6ab7b3db1b84c519b5767d8799f2b885a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373077, "uuid": "4eb8dd4f-936b-45c4-bda4-db56f9de9512", "comment": "Malware payload", "value": "0e58d660389cd4e7c476f3e582e56389e0531e8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373077, "uuid": "70d7b53a-1aaa-4f2e-b594-329340b73a90", "comment": "Malware payload", "value": "0b97b14a16f86757f25ee2ae1925814535ae628cccb2e448c456e6676a30f0c039497c8cf01ed236b04f8886e4d6a590", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373077, "uuid": "da38405f-9fd9-4b1a-b02b-8b4953c94a4a", "value": "T1B84261EB1A460377114342E9765CB5EDE376D5AC66F79550B096C0380B80EB2C73AECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373077, "uuid": "49b9641d-85f0-48d4-ac7e-535201936146", "value": "192:MsSFs5y3We+sNEIHzPolsSxsQSuHiJNIHzFsUsEsVsG:MsSFs5G+sNDHLolsSxsQrHBHJsUsEsVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627373077, "uuid": "59f491c5-ae71-47cf-a32a-7266e2f1b0d0", "value": 12008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627373077, "uuid": "cf3cf0e8-62b7-4100-b2de-7db30c347d31", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373077, "uuid": "e93e8fee-c762-46ec-a440-c8c362abdb57", "value": "theMillions.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24c4181-ef02-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627408042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408042, "uuid": "075b604a-91da-49cb-81f3-29faa92f24af", "comment": "Malware payload", "value": "ab99e71c87f024b99c10c02f88b3e40b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408042, "uuid": "514d8cca-bcd1-402c-861a-a0ca615cf289", "comment": "Malware payload", "value": "ae23b1d2d4ab785d755af246d6d82fca9fab091dbb4f886ac136812805354efd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408042, "uuid": "393f7b47-d684-4f47-8ede-cef890edd4c9", "comment": "Malware payload", "value": "6ef978264ec7c26011e1ae99f5f5e245107b0475", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408042, "uuid": "efedafe8-eb5f-41a9-8b9a-2b861dfc875f", "comment": "Malware payload", "value": "69eb94eadf9e5f77bd6900a604a9945ee31e160e48bb874dec9b4087dd294d2c9298f06a3f9f5904498b5dd023dd7170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408042, "uuid": "2c2a92b4-9b86-490b-a2fc-7e1d4855f42b", "value": "T1D8436B1379F2C173D692457228724F4B9BBFBA311A749A5B6BA40B4D2E31590CA3F307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408042, "uuid": "27a97784-1b57-471e-82de-c6ff4415326b", "value": "bf43a37a6ae0ed2852f82f44f0a6f32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408042, "uuid": "610af927-c18b-4d2a-93b9-8704f60cebbc", "value": "768:noyjFenzoDcTEZF2VtC7Nrcti/S/Lr1teel6+:nSkITZCOt2wrzl6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627408042, "uuid": "cbf2d1f1-c397-4f71-9866-07654ccb88e8", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627408042, "uuid": "b41fe9f6-e639-43fb-babc-852cfdad09a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408042, "uuid": "37438211-2ba4-4589-b7f1-08c683dd45e2", "value": "ab99e71c87f024b99c10c02f88b3e40b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a810e7f5-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627396858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396858, "uuid": "a0931305-5b18-4263-be56-1fd2fd7692a7", "comment": "Malware payload", "value": "1f45bcf1fb8b7ef74a57d19a371f41cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396858, "uuid": "2c48c38a-21e2-4bbc-a3f6-38e95f619713", "comment": "Malware payload", "value": "aee116011409a5bec7d356bd8f704df0a361fb029bf20178d49e02607798d9a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396858, "uuid": "a10fe62a-b3e5-4600-9d67-c97183fef289", "comment": "Malware payload", "value": "9b7f346a04f8481c22fb6f8853f76349402a7009", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396858, "uuid": "3796815b-5bbd-4478-b85c-46a546897c55", "comment": "Malware payload", "value": "674856f1d65c136f5be5273b1d388dcabd5eef05421db13769c648f42396118d3d94abf278a5c86e3a6b135f0c89fbfa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396858, "uuid": "d9c5b1ff-e8f0-4ced-9b87-626efa667932", "value": "T1A6554B077CE508FECA7EE131445392D17A327C6487362BD72944656B2ABABD83B3D324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396858, "uuid": "a3510a1b-2fcc-4bfb-9379-f494606be3c8", "value": "2869cb885758b15d003acb119f131468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396858, "uuid": "32227232-ad40-4cff-b0c6-c469d139db94", "value": "24576:ax12nIqqCgOgFO9fccuUMHKv+i7e1LXEdFoGzIyXjxeKr:aYIqJPV9fcHqmGSr9or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396858, "uuid": "44e4eeeb-3554-4f29-b8be-abb647ca2f7b", "value": 1385610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396858, "uuid": "ec2ed844-2dae-43d5-b8d5-d67dcb4e87fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396858, "uuid": "81736049-83fe-45f2-992e-c5e6b3755948", "value": "nady6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a546ca-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1627400258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400258, "uuid": "a2774674-9a4b-4acd-8cb8-7ff9dd546bdc", "comment": "Malware payload (Smoke Loader)", "value": "0e496e74ee09b4467f25f8350e5b089b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400258, "uuid": "99e617ab-eb9f-4488-89d4-3dec4d3f5fcb", "comment": "Malware payload (Smoke Loader)", "value": "aee59b3208def311e9fd082182c861f9b57d73f1535905675e73bc6ceadcee2f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400258, "uuid": "63f7d2ed-9e90-4ed4-b21f-3c67204281a3", "comment": "Malware payload (Smoke Loader)", "value": "f938fdd56c3efc912c453e8923e8561691fd4008", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400258, "uuid": "e65ea1c7-58b9-48ae-b16a-7276a1d5663a", "comment": "Malware payload (Smoke Loader)", "value": "1e21a9d6e7a7517ea636d22e35b2666fe5fb92b67867337f1fef07ebc01b2e655c33fbdad75b5911eb919a19fbb7ae4a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400258, "uuid": "62baf214-303b-43e2-9903-c1b07f257686", "value": "T1CF648C30B791C038E5F212F8497693BCA93A7EB19B3450CB62E53AEE56341E1AC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400258, "uuid": "5b1d510c-3910-479e-9cfa-9901f6fd91f6", "value": "0724b6e67f50109c65fd8c6025d37cf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400258, "uuid": "60d4db92-3585-4d76-8be7-ce50564381c2", "value": "6144:9CEGu95b36FK6fYQKdrPT4TyaM0vmSH0rCSLhclaYUX8Bynf:OW5bqDfgrsTJMy3HotWlaYUX1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400258, "uuid": "8d28b87a-3c77-44ac-951e-3ce243d0a5e7", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400258, "uuid": "6810e2dc-91f1-45fa-8d26-6a0685b428d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400258, "uuid": "7aebc19a-b3e7-4994-bc0c-e4f6a4317340", "value": "0e496e74ee09b4467f25f8350e5b089b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cd260c-ee87-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627355273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627355273, "uuid": "8830b513-ac33-465e-b8cc-75de8abd5417", "comment": "Malware payload", "value": "2b54ccc44e89581b1005e8b6f24a7822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627355273, "uuid": "bde3711f-cb92-423d-a522-314838d2c6f3", "comment": "Malware payload", "value": "aef5c612c2920526ea0ccc636e689417885c2dfb17793de9a259d6ced6fdd7cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627355273, "uuid": "6b5fd858-7439-4a1c-8219-09601bb45a41", "comment": "Malware payload", "value": "d7de533078a3d1204e1a0c9440501928e0cf1285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627355273, "uuid": "20e7612a-0e6f-4d32-81a0-e30da9fc6389", "comment": "Malware payload", "value": "63ae409f2de9f09790cb31f878fcdf6b773edc89ab4d08f1692bbd58ccfcb0292a991c10a83a91faf8bb9a52616df955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627355273, "uuid": "febe486e-da9c-4938-b65e-9ca6b331e73a", "value": "T1C926338AC3A32152D6041AB83D5C15C84434BE76449DC2ED37D9FD2EBFBE395CEA8096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627355273, "uuid": "bb341081-1acb-48ea-b092-00243c6da5a1", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627355273, "uuid": "d0487c22-3484-4c6d-82c9-5693fd8f0e4a", "value": "98304:8egQ59+/2UJtuHRTcJ1VzRasOnSDyE8m9j1EB+:KU+OdTejOSDyu2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627355273, "uuid": "49916312-f216-4fca-88cd-f80b5244eb68", "value": 4817048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627355273, "uuid": "cdb399e4-fff5-44c9-a073-1cf6ee75cf0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627355273, "uuid": "d8ef8f43-cfaf-4ba2-acd6-c21361900c25", "value": "2b54ccc44e89581b1005e8b6f24a7822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7881d5e-eec0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627379731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379731, "uuid": "201b33e6-5e62-4428-8fca-f687ede29078", "comment": "Malware payload (RedLineStealer)", "value": "a028198b84610db467785198653babfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379731, "uuid": "dc013567-e9d9-4c99-bd9e-d5772c943ff8", "comment": "Malware payload (RedLineStealer)", "value": "b0b851f99f1cc076735446c7604066a790017d08654f864851622781847ea92e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379731, "uuid": "1f906e0d-b622-44a4-861b-989ba539936e", "comment": "Malware payload (RedLineStealer)", "value": "9436f161cad83e3cfddfe40e49e69b3ddd1f6b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379731, "uuid": "8959e2f3-79af-45c9-833b-689c253c2ac8", "comment": "Malware payload (RedLineStealer)", "value": "80cf9435b9afb4dce97c40df44f7a655fd6d0bcaa41c7f57cd343d39051704db60ba1088ce3f96c1067a61bbbf7b06ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379731, "uuid": "e74cd557-6ce7-447d-a727-e7f19e8474fd", "value": "T13CD52303BC8659B3D0B1583215297B6539797C200F189BEBF3D42A1EA8391C17B35BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379731, "uuid": "cc05858c-afc7-4824-82d7-3790f864afeb", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379731, "uuid": "399324ed-9bbe-4fde-9837-5c4303a07532", "value": "49152:J84p0D/dPoSiACDoVa7i58KcMDVFsld2D38hguVlcplz9dewCqE1EZ5G1:JWREAH+i55coKd2D343alK9qX5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379731, "uuid": "a19f57b5-59ad-442d-9fb7-3a11818802e5", "value": 2923201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379731, "uuid": "627d55b5-ce71-422f-bc51-f4cc477c2555", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379731, "uuid": "2984e8db-a14b-485a-8a4d-61dfad0a17b8", "value": "a028198b84610db467785198653babfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e91805-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627399893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399893, "uuid": "73dbdf64-7712-4036-848e-07097bf0c0d5", "comment": "Malware payload (RedLineStealer)", "value": "26808e9fe7def427eea65c3f4b1c7838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399893, "uuid": "1c29fac6-b761-4207-9310-99f1274ce51f", "comment": "Malware payload (RedLineStealer)", "value": "b0c5d41fc112355182211c211ca210868a68c18f199bb7e4cf115650531d19a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399893, "uuid": "aaaa7e6f-db6f-4679-8d20-40ca7605c30c", "comment": "Malware payload (RedLineStealer)", "value": "36b67b700b9c6c84851ee50211e8a3f714ff8412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399893, "uuid": "40fb9ff1-ca72-463a-a630-bd56514c69dd", "comment": "Malware payload (RedLineStealer)", "value": "278c54d4ee7381c422ecd5b2b0ebb119fb017e45cb30a54d3cbfde3dacc739329db95e20a0b929d7e799b6cce3afe1e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399893, "uuid": "4d670718-9f44-4aab-9afb-0db0f485c9d3", "value": "T187E4E020BA91C039F2F351F8057693BDA93A7AB1977410CB62E53EEE56346E1AC31743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399893, "uuid": "c6afeac8-bdf8-467e-8f9a-c008e88c46dd", "value": "0724b6e67f50109c65fd8c6025d37cf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399893, "uuid": "c392767b-d9d6-49b7-8b07-90440a258fe9", "value": "12288:NS5IGrnGSldQcMaJHoJlPYKtcKSK2XBb/lDPYXhjnweX/uaHyc1HKTkzZ3W:srnGS419Rjmb/ZPYVHrnZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399893, "uuid": "e277916e-861e-4d10-aa8a-5484489265f1", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399893, "uuid": "cb46f75e-8ec0-4b5c-bf0e-6af4a8d6ed9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399893, "uuid": "960950c8-f95d-4527-b535-b0759b98832f", "value": "26808e9fe7def427eea65c3f4b1c7838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5046095-eec8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627383136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383136, "uuid": "d5e2050e-9fbd-456a-9750-acddb6992990", "comment": "Malware payload (SnakeKeylogger)", "value": "f014241e8c93d4dbafb85339eae88015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383136, "uuid": "e2eb233d-c703-4f60-a6b1-16e4af4f389e", "comment": "Malware payload (SnakeKeylogger)", "value": "b0cc2b05abaf593a784bb9d83cd0a61bf5b218605f61dba802df21c8ea54c7c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383136, "uuid": "17eb91b4-a772-431c-954a-88cd127732f5", "comment": "Malware payload (SnakeKeylogger)", "value": "9c5599c4f75b03928576778ec87a55d56d3cefde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383136, "uuid": "255f83c7-11ae-4622-ae9a-6607b74e14e9", "comment": "Malware payload (SnakeKeylogger)", "value": "ad8e86d23ddcabfdbc158ce5688594831ba54092648bf4952942d2734c1f8059bd504312da83674193ccd4388fef66c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383136, "uuid": "4d4e4493-aa2f-4d26-93d6-f5644dd07310", "value": "T184C49CF83539375FF48384BE54B45CA2695060FAC92EC792F32342AAEF1C49B99406D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383136, "uuid": "9f8fa7ef-66dc-405f-9c0a-5ccbded5b29f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383136, "uuid": "f4b2f182-57de-49f8-ac42-0970a683a059", "value": "12288:0JLLLrNfcdb6I8LBqzdhRv8rjGiLnM0w+aa59oeGHcm7mo5oFCEkv:wNf0gtqZcj9/wR7mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627383136, "uuid": "c539d732-3675-453c-b8a3-0ad5f8c5da76", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627383136, "uuid": "e6c5a6be-70cb-41eb-baa7-ef209da63f68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383136, "uuid": "531bbddd-d4ec-4556-bbe4-6d004ffc84e9", "value": "SecuriteInfo.com.Trojan.PackedNET.954.30622.21525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f498065-ef11-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627414318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414318, "uuid": "d1c85e9b-a737-4abc-a30d-864f33b34e1a", "comment": "Malware payload", "value": "5f0f316459cf8e92f8705124acdbe3e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414318, "uuid": "18b4c824-351b-45a5-9f2f-5378535a565d", "comment": "Malware payload", "value": "b118e2deb33dc46a4ae01ba586feafcae96251267ab36dee8aa7f282b7263d13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414318, "uuid": "9b40deab-2478-4a30-ae8f-8148aa059301", "comment": "Malware payload", "value": "dd8ec58e0fb787491eae153bd02d3be825fa8f3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414318, "uuid": "e3093f3a-dab7-486b-97e6-ce005fc9e42d", "comment": "Malware payload", "value": "8283c9af6f5d93da7ddf6945b30052e04470a3a50d1f6764be4c667136a98ea53a45820ed063d313427437f1f464c49a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414318, "uuid": "7a8b0328-9ef6-4039-a965-850ccac4af31", "value": "T1D1F4F130BBA1C438F6B611FC557693B8A53A3A715B2440CF53E62AEE5230AE5ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414318, "uuid": "1c2aabbb-1389-480e-bfa1-e2ad66f3a5ee", "value": "c6ebbfd08d361ef29153e4487e25f820", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414318, "uuid": "db55e20b-3d18-4286-b2bf-cde3599a5b8e", "value": "12288:7n5IQdj9J0t1CIQklyPGt0dPf2OgiCjwnRl/1T7xu8+3oIa1oDVLBTv5NKrk52mB:7Nut1CIHlgGOgwnTu3zRtTX2kLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414318, "uuid": "8eb71c16-184d-422c-a56f-5c2080c1abad", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414318, "uuid": "a24f30f8-c290-4818-bc86-4b9b378d08d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414318, "uuid": "7fe17476-a621-4eba-a549-d18e42940369", "value": "5f0f316459cf8e92f8705124acdbe3e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c64f20-eee0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627393368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393368, "uuid": "03af19df-66d7-40f0-81b7-a46ad1302877", "comment": "Malware payload (Mirai)", "value": "ea5a8668c25d1390974adf82454a36d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393368, "uuid": "07be78e2-d091-4da5-9856-59db12870227", "comment": "Malware payload (Mirai)", "value": "b1c753fe541c01b4336bfa904491f6ca6eadae298fcc4411c01e8d17ec51c5ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393368, "uuid": "dc48845a-3041-4e4f-b503-4cb28d2eb4cc", "comment": "Malware payload (Mirai)", "value": "f27e4f9181da4bb914eb09827e49e1ccc1f2b004", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393368, "uuid": "5bdcc8fe-cb4c-4542-b43a-5ffd02d5195b", "comment": "Malware payload (Mirai)", "value": "71f80ef619a2bdf87d87ee522dd3258d0fe50c81aebd9c50e210eb84162c78354614d0b07cb99e2e8b7dd48c384fbc8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393368, "uuid": "d54dde49-963a-480a-b3be-3edf0fb2edbc", "value": "T18013F782B58B85F9D8270A306067F73FDF31D929007AD16EDF69AE34DA375C1520628E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393368, "uuid": "090ab9e3-708d-4ac0-86ae-2592dec824e1", "value": "768:LHmPJt0aaOztopNU1nynZMVvngvys3pcVuqmTG04rl+:DmPIad+bU1nynZMVC5quTGPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627393368, "uuid": "caef6ead-1c50-4ac9-92fe-8e8a6355bb2a", "value": 41608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627393368, "uuid": "f79e98e8-24dd-4bfe-a130-2506ba1014b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393368, "uuid": "0ced3af1-deb2-4cf1-b97f-baad48926e8d", "value": "ea5a8668c25d1390974adf82454a36d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fac8441-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627366323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366323, "uuid": "1bd2a099-e9a1-436f-ae29-5cbc2081bd43", "comment": "Malware payload (SnakeKeylogger)", "value": "5a4a93f2575eb856a8eefd6e51480edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366323, "uuid": "de992d93-31b3-4970-8578-eae50ee88683", "comment": "Malware payload (SnakeKeylogger)", "value": "b3139cd800107b9fe4d5bef34bbb21281c8a4432adb990be5f4e99c3df3a86eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366323, "uuid": "18f74242-f103-42ae-90ae-ae9e81c8f38f", "comment": "Malware payload (SnakeKeylogger)", "value": "67a6a61e29fa3d676bd3a2c3f41eb3bdeb38fc0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366323, "uuid": "b48ebd69-2170-433b-9e61-5cbb655d5d4b", "comment": "Malware payload (SnakeKeylogger)", "value": "72d7c7937acf6994732a356d4e00e9b6999b40bb00472995095508a3e4d9f455664faa66ec70100fb12ab11eb2f832b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366323, "uuid": "20d9cce3-c63d-49e8-b986-6f8fefcad515", "value": "T118B4D0813608C18BFAB91BF12C8F407015F07DB9A5CA914F77D2773A59B2B9041AEE9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366323, "uuid": "9982a754-becd-4689-98cf-0f006a3fc73c", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366323, "uuid": "4d2cca36-8f7d-426a-a591-bc688c3db5a1", "value": "12288:Ld53TvpHeIl0qH98Xcx0JBv1N+GUhL95gU9k3OsJ2a:Ld53TvpHeIl0HCz9SXJ2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366323, "uuid": "35bf93d5-b548-45ca-b7a5-101d2ae7a11c", "value": 503954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366323, "uuid": "b07b41ec-c33e-454b-ba60-36e153062357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366323, "uuid": "03768827-f4d4-4ae2-a7c1-a77e3fd9de81", "value": "000900049000T2000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b480c642-ee81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352641, "uuid": "d304d695-5cbe-4347-bb33-81da489218ff", "comment": "Malware payload (Mirai)", "value": "856022dc4e80cc88a0df2914eeffa690", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352641, "uuid": "b2aa2306-63a3-440a-b64e-216814149676", "comment": "Malware payload (Mirai)", "value": "b3fe5c359201114c7443c5814c73ee7e61a4cbdbda351f62c23bd1061e26339d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352641, "uuid": "a1e95290-d0cf-41f4-9e10-7edfb26f3d8a", "comment": "Malware payload (Mirai)", "value": "d266de1b87f4450cb05d1ba3cfb890f56bce390e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352641, "uuid": "ca1bcd6e-5736-4a10-8ae8-ea97bb50518b", "comment": "Malware payload (Mirai)", "value": "bd824edabef3b2c749d4a075618e4044ca05e5b56b11ee5467a6d6871ffe83c2dd4c58b818017a171511ea8c26600a06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352641, "uuid": "adfd04fc-bd79-421f-b3d3-6c66ece622d7", "value": "T121E2E1DC5E6E80F3C8745E39AC75C9873E69C7FCD68AB02B06408E09BFD2C5524A6487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352641, "uuid": "1ea57dcc-d981-4389-89ba-b7140751116f", "value": "768:ZHY/M4HmzcmjVkGYKKNZUHfaHvVkgt9q3UEL+h:ZHY/M4Gz7DKNZgfMvWLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352641, "uuid": "e9f237b2-fd7e-4bf9-b458-93f3a135f36f", "value": 33572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352641, "uuid": "5e0cb39d-0feb-4c89-9341-94d326e32637", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352641, "uuid": "01825eb6-678b-4785-9248-771279b3eb58", "value": "856022dc4e80cc88a0df2914eeffa690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a50dc2d-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401855, "uuid": "5768e7c5-d948-4a6f-a030-753a9ad39f39", "comment": "Malware payload", "value": "a72018d99d423661fe708f34b1fb247c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401855, "uuid": "ae435741-6849-43f2-9ff1-2c4cbe371cba", "comment": "Malware payload", "value": "b44c8b187e13cbf62ac1718efbe1e35d0a17fd1f89fe0fdc5bdfe3eb7e3c3ec1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401855, "uuid": "139cbdb6-1001-4791-a913-b01271b0a410", "comment": "Malware payload", "value": "e5e952352da77beaaa3b4dd11d2906a05b252d9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401855, "uuid": "363731a9-1668-461e-aa2e-755a2c51cf57", "comment": "Malware payload", "value": "9771cee280e6efd82a54abf807e623104e5e91fe3fb7740bea6b8a0c04a0594156b25ffe65b97223cac45d5a73bc107e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401855, "uuid": "369131b3-e8fe-44b8-a404-33af5a1d22d9", "value": "T1EEF2F170A7412AE1C4E19A31C6FB011BAA56035FF57AF9A36C48261468EB61F1CFF50F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401855, "uuid": "3551e9e7-727e-4b34-802b-e29e9780bcc2", "value": "768:Gk1Ad+hrTxdXhyT1vSj9CntH7tLbE5klRyY0IkLA6vSBaQ1/x/MJ3U+:Gk1AdGrTxdXh4vSjUntpLYklR3kAB/ZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401855, "uuid": "b6556536-fe85-40cd-b0e6-fef571397f1e", "value": 36444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401855, "uuid": "36ad0f35-15bc-4272-b519-672ef23b2097", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401855, "uuid": "4289159f-4a74-4a1d-a83d-04c85f17b836", "value": "a72018d99d423661fe708f34b1fb247c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a19499-ef12-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627414628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414628, "uuid": "f29dede0-ac78-40fe-b002-61c882c40834", "comment": "Malware payload (AgentTesla)", "value": "65c520abdacd8aacdb7f93ed7b00d716", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414628, "uuid": "5a9aeca9-edf0-4240-9818-998234fe732d", "comment": "Malware payload (AgentTesla)", "value": "b47c11b0e48a16e4e1d861dcb524bf3bcabfe1481853b7d94fb738f635d1d5aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414628, "uuid": "d4391e78-4d04-431f-8488-0b189dde902a", "comment": "Malware payload (AgentTesla)", "value": "c5ca68ab7ce2e46e0b924acb0365af5f4935847d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414628, "uuid": "525403d0-8605-4e5c-8918-b319b5a8d001", "comment": "Malware payload (AgentTesla)", "value": "03622f8ef194b6de774216b4f7e2bd10921fe3ffec706d64597cba763d0a8b9c3d7c36e67fbe146c9766940ebdbd712a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414628, "uuid": "46faf7b9-be4e-40e0-9fd9-b245e48e1c89", "value": "T122E4E0B0B641EC12C4595E7A0D679ED48F337A87AF07A75A3040737F3DB27C18A69682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414628, "uuid": "f3185af8-cf56-4e01-b1f2-035c93a12848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414628, "uuid": "a062eea4-c3a5-4b0b-b071-81050cbe2992", "value": "12288:gCPIyPKREnm9jLV2r/CvmJnSzNLbUiKaUaapyexLAfIttVA:g0XCRpOCcnaPUiklyaLAfIttu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414628, "uuid": "e7e1afd6-24a3-480c-9a07-f051f66cbac9", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414628, "uuid": "2b314bbf-9fc5-4630-93e3-a2ea49f549ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414628, "uuid": "66069cec-6b3f-4cae-8241-8a725f8ebde5", "value": "#$$$!1weF5(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af284a9-eeec-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627398366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398366, "uuid": "d31d15a7-f4d2-4630-8566-cfbf91fff58f", "comment": "Malware payload (SnakeKeylogger)", "value": "4d40ec3083581c3ee44936d9cabc9e0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398366, "uuid": "f6ee4c23-fbb8-449d-9daa-eb455fa2a38f", "comment": "Malware payload (SnakeKeylogger)", "value": "b51b212526d12237e7bcb3b215980f65e35f717ef6d39d0a2791f8fe3ce52845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398366, "uuid": "32650bd4-ec96-463c-b6de-fcce91d3daaa", "comment": "Malware payload (SnakeKeylogger)", "value": "b57c1d6d2e4411519487e9d132a3aaf01b80448e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398366, "uuid": "e6544a61-b833-4435-9ed2-d44a1c4340b0", "comment": "Malware payload (SnakeKeylogger)", "value": "d552572e2cd9945a1077c80a8ea6065d349aecc53abe7d4815eb114c39d2093652c9a4ce4503bf60c18cf4566553a478", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398366, "uuid": "4867f7e2-d52e-4486-af7d-edfecc261898", "value": "T11735D02763176B48EC7DC3B86825A484AFF5F407C31DD65D3ED8B0E96872F149BA1A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398366, "uuid": "fd2575d4-6329-4a55-b4df-7cee06e7b28b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398366, "uuid": "704f022f-5138-463d-b1e0-aee68f4467c5", "value": "12288:GaWvKkpeBoWzJlKqQdQEYKEyvUIZbV4LMntu0skGRmbK9ua4Xr4UiZ0gntsUIznx:GajydQEYKrvDBu6u0ski2KMaAe/gb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627398366, "uuid": "4a555899-306b-4fd5-afb7-77bc68c135e5", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627398366, "uuid": "1291c8c3-be9e-477e-b186-d1039376e64c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398366, "uuid": "2553e3aa-02e1-4374-9e10-0b514ea281a5", "value": "PO_1223223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e287768-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627375662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375662, "uuid": "a6d6ddd0-178d-4a1a-a44e-fdff1cee69f6", "comment": "Malware payload (Dridex)", "value": "bde2b9dc7dab9e930be10b75dcd171ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375662, "uuid": "9b981b9b-16df-4c06-9e86-d0bb49cd0138", "comment": "Malware payload (Dridex)", "value": "b556487ae4d889236c1626083b0c9d45a29a5c3bc4e087bf2e3245b6a18ed2db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375662, "uuid": "300d0bfe-5e36-4f85-a5b3-3064b69626ed", "comment": "Malware payload (Dridex)", "value": "8dfeed50d89f5a2264efb31e5f74816b49c148fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375662, "uuid": "73b37658-bb15-4776-a3df-e29448789780", "comment": "Malware payload (Dridex)", "value": "74d18e02e9b1e44b37bf25b62af4bf37c045f58ab31d48f7494fc2d792076442cebed7c95f3849b960497ac5ee2735ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375662, "uuid": "01812779-f6f1-4577-a8c2-3847fb63f8f3", "value": "T1E074028AE0FAC046FDDF11376A861FCB9A17FC675ADC91B4D7207B6CC101FA92A52142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375662, "uuid": "7a4435c2-bf30-448c-becd-71979ad68dc2", "value": "6144:2EOj+sWRo6tcJhv7Bzg+8h6F493OzNStiln83OHofpSGjW:2X+Zenzdl8OLzNStzQEpLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375662, "uuid": "5cfe5bbf-005c-4042-a96c-5ac889e6980b", "value": 339507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375662, "uuid": "fd150e54-29f7-4961-86df-8d032c465b3e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375662, "uuid": "e2bf88fd-762b-4077-8382-8d657d1aa9af", "value": "Invoice_8384252.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50000986-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1627371799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371799, "uuid": "7dea525f-4758-424d-beac-dd2e0f176b22", "comment": "Malware payload (CobaltStrike)", "value": "fd3f386397ab9f626b2888e40a7998c9", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371799, "uuid": "100d2c89-ff94-4343-b14d-9192514920c9", "comment": "Malware payload (CobaltStrike)", "value": "b735bf8a33209f968ae46a4f632bc07bff6ea83f66130934365b5be363657fd4", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371799, "uuid": "3d01322e-0352-4261-a35d-d19c77e2f87b", "comment": "Malware payload (CobaltStrike)", "value": "a53c33779e705674531c5bf7af547e54107282f4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371799, "uuid": "ef0df696-215c-44f0-b89c-3ed21c84907a", "comment": "Malware payload (CobaltStrike)", "value": "1f168cb3e18a4ef9d5d573623d3884afe7614385b16b8ac76ce1b6d43034e5a4aa54da3fc16cb6538210da8991729201", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371799, "uuid": "07d85029-4a47-4236-8411-24a7bbb99e4f", "value": "T169567D13F8AA24F6C6FEE13085619322BA71386943313BD35FD4967A5666FE47A3D300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371799, "uuid": "120dc620-b577-47d1-bdcb-49e5d3eb4f00", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371799, "uuid": "ac62be54-586d-407f-92cc-1e067f8fddf8", "value": "98304:4WfpNGBkh9DALtSl8+E5kTq+AvulpwCGu9+I/i6IqBxO:4WhNG+h9DAol8+LVIxu64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627371799, "uuid": "2306bc7a-e0a1-4baa-b680-329fb2b6d267", "value": 6422016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627371799, "uuid": "b0f38ea4-737c-4586-9476-66d666acbaaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371799, "uuid": "e0843776-3be0-4adb-9594-e7b52615e0a7", "value": "fd3f386397ab9f626b2888e40a7998c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bea165-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1627366301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366301, "uuid": "34fd6a97-5d3f-436c-a7a4-681a072a551d", "comment": "Malware payload (QuasarRAT)", "value": "113f59d0bd4384226e40c17bf899935d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366301, "uuid": "bca03ab7-cc7f-4dbe-82f1-991524775a35", "comment": "Malware payload (QuasarRAT)", "value": "b77f7c59b071608e552cf6ccae6f9e0e3f6790d83ec7d163713b0eedc6eccf25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366301, "uuid": "1646a379-ff97-4046-a203-55332543f902", "comment": "Malware payload (QuasarRAT)", "value": "4bf159402cefe87d328182fee0e82297b1fff5c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366301, "uuid": "8cfcd510-372b-4db4-9325-5a9055ea432e", "comment": "Malware payload (QuasarRAT)", "value": "2a210d1f40079f2471c2497ca67b0067292b0b00bb41598e8cae9f00e9c947389635127a64174d6077f8ffb5a3426b9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366301, "uuid": "c538694a-be62-4550-bb3e-d633971c9d58", "value": "T10C255A3439EB502AB173EFA94BE4759ADA6FB7733B07A41D1091038A4723A41DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366301, "uuid": "84c33184-670b-4991-9373-4da9ca74de7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366301, "uuid": "2a3444fa-528b-4a79-ae48-4bbdee2d5868", "value": "12288:gFrXv++Cjkemhes5D9Bq1U50kb9zU9uRyM3/CsUABjFG3CiEN4/PosRbOt/kUQQj:gFrpCDsz2SCyiJA+O9ENGZOMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366301, "uuid": "be459ce9-d955-4d52-838f-0ec3f4423036", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366301, "uuid": "36f48bcb-0ca8-441f-8be4-98c097df5339", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366301, "uuid": "fb46f60e-891b-4b83-98f2-1418ee8841a3", "value": "000100049000TK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37e244a-eedf-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627393065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393065, "uuid": "ddfcdd8d-32f4-46fd-8b32-5ce40ef9555e", "comment": "Malware payload (Loki)", "value": "66da45ed268a07990768ee03d70e4502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393065, "uuid": "cb433c59-5550-40f3-b249-fe5f3f9c9c02", "comment": "Malware payload (Loki)", "value": "b90e3f203d5736096b41b710e1fa0ab10f26025e84e4fcf1e4bc760a0306ed72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393065, "uuid": "e8a1889b-6bd3-42e5-b5a4-22cb0d0261d7", "comment": "Malware payload (Loki)", "value": "3cef4bb7af1179eabd38cd1e1989dc9c41f5c69c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627393065, "uuid": "e8b589ac-08d1-47b0-9444-a584b2a75d62", "comment": "Malware payload (Loki)", "value": "b2733013ad262889338f75c99b4fe389226b87d8811d3a6a09f56f3c04ae6c79f14170da09d09ca79f02386448f4a805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393065, "uuid": "ac9ea5b0-7c00-48b5-91ab-4bbacff1596a", "value": "T1D1C4ADF83539775FF49384BE64B41CA6696010FAC92EC792F33341AAEF1D48B9940693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393065, "uuid": "c49c63c0-5702-470a-98e4-e763ed851671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393065, "uuid": "468c3517-a5ae-46e1-9d7b-cc00f44c32f4", "value": "12288:0FPbjyWOXgBsLkJqD/nAkPu7mo5oFCEkv:0FenLkCg7mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627393065, "uuid": "7fe00a10-dd62-402e-bf7f-b7f3d6639c14", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627393065, "uuid": "d00c80b2-87ec-4671-a754-b30558e6f52d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627393065, "uuid": "c595c51a-3e2a-4172-87c0-2b3f60304ed8", "value": "audiodg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c73f7c-eef2-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627401035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401035, "uuid": "4b98846c-5cce-4940-9e15-a8f1ff88da81", "comment": "Malware payload (Loki)", "value": "541bb6e026f837faa2b64b31b0a2ec0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401035, "uuid": "d1ac9dac-a102-4151-af8b-2e39efe3e162", "comment": "Malware payload (Loki)", "value": "b916cd21d5759f9c2e98aed2297b0d2f0201f8390347856b37e493e808132153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401035, "uuid": "84882891-5780-456f-83d4-3eaac8caa851", "comment": "Malware payload (Loki)", "value": "1cd6d3ceae4177bba8add5ef473b80edb6bc55d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401035, "uuid": "79e55bf9-ec81-455d-86ff-c667ddf64de9", "comment": "Malware payload (Loki)", "value": "78cae78df16838889c527c0e3c98bc2325cf597fea1293ca0a30c50f80e3acae09a3a58e945ae937cb36f5be8b515cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401035, "uuid": "43a6c032-3adc-4b9d-878c-b6b4639ed4e5", "value": "T10D05F1263227A218DC3887F55C28D1B12BFE6C1A522DC7782DC8AD7F7DB36785AD4181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401035, "uuid": "af9d5bf1-6e59-462e-94f5-f989d611d478", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401035, "uuid": "cf94ab68-2261-46d6-9f97-44a618abe496", "value": "12288:hYL32wyvUIZbVlBPI2VBPSUK2p6DL9HDzr5sb56uOtisxndPkMRx/TlobC9lqQr:hvDBlBPIOBPS9hL9jzFOOEyd5TGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401035, "uuid": "3e307c53-5ff8-47b0-a55f-15047a578276", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401035, "uuid": "bc410e85-3b3f-47e5-94c8-d63ee7dc0c93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401035, "uuid": "f51deb33-6460-4e3e-af51-e4a853a63b71", "value": "541bb6e026f837faa2b64b31b0a2ec0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d06a174-ee82-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352897, "uuid": "9e5ebfba-066f-4029-af52-947bf9124ad2", "comment": "Malware payload (Mirai)", "value": "2b4196e14bd4d29784407b2df2575a54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352897, "uuid": "64e14982-0982-4dc9-8a2b-f318dcc5b928", "comment": "Malware payload (Mirai)", "value": "b9be24ea1540ef53b7ab02e48fdb9e2c790de94c306a9113576bc177bb46e482", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352897, "uuid": "26a95c4a-a915-4798-b80e-6c2f47bc1532", "comment": "Malware payload (Mirai)", "value": "363f2ab3b224e2934e2b81c031dc209f85ada2b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352897, "uuid": "fe5a5bf9-3551-4c47-8238-61409e4a85ca", "comment": "Malware payload (Mirai)", "value": "a86b3b245991f30670afbb51d16966d871766bb28cc8a19b40117bfb80cacd6389519e5c05b8c9a6a8801cad1bc6f739", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352897, "uuid": "c7801d9d-d418-4e10-a24f-7a6414344009", "value": "T104D2C0F5613179F08369027EFCB6C54A444DDE70A0E433513AB0192A68C6A45B7FA9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352897, "uuid": "09d236c8-45f7-49ce-98d3-04dd7f17e254", "value": "768:r4cQnKxU3kV4wPR9cHOYGTriFNFbpR4ZH3n7buMYas3UozR:rmD3kuwPcHlGAIZXn2MYXzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352897, "uuid": "f83514d9-34a4-4955-b7e7-31baa27d03a9", "value": 28612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352897, "uuid": "f7ae8194-93e1-4768-93b8-76a76c79fd68", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352897, "uuid": "1fbcae53-d156-415b-a199-f887426fd320", "value": "2b4196e14bd4d29784407b2df2575a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b5247f-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627413796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413796, "uuid": "06b8c91d-9bfb-4519-bf2b-7ec69ff6225e", "comment": "Malware payload", "value": "b436d9b3aa80ed085135344794c4e44a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413796, "uuid": "430d521c-c00f-471e-a146-06cb7411cfbf", "comment": "Malware payload", "value": "b9fcbec47bf5aebb2f11ba02d605905e74f849bed05e55f82413e2df83c8bc2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413796, "uuid": "c974213a-6474-4c49-98c2-e1e0f5f39e0d", "comment": "Malware payload", "value": "9d51279617a4bae5f4e5d3fc12de45c490303aef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413796, "uuid": "7bd7e941-09fa-41ac-a73b-05e6b6a3afa8", "comment": "Malware payload", "value": "5128ac59abe045b6e4f20a8bfef56be894bf70e3e0a9db529219a9a92a591fd044a5f4edf24d8943c0b44ad4c2aef1dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413796, "uuid": "3a7404e1-2a7b-4fab-ace3-55a28302fe0c", "value": "T1E1332B8D68121D2CDAD358FD50729F0E9E552211A0A3070FA7ABFEC33D33269EF55989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413796, "uuid": "38b42207-9ccf-4238-8012-e8cf4f58927a", "value": "768:mouzcCsm4ru2IGh6HHaihHHeIXXdauZj0CGeWxCyVBXtM7edUo+f1prwGknQexba:moqcCyrBIC6HHaiFu/eJ7edJg1pkDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627413796, "uuid": "08989014-b9cc-46d0-9b6e-e56043f8e9f0", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627413796, "uuid": "0d453651-9c9e-45d3-a4fc-0baf4b5060f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413796, "uuid": "2850a96e-54f8-4fbf-b5d6-53f02738a54f", "value": "b436d9b3aa80ed085135344794c4e44a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219feec3-ef0b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627411665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411665, "uuid": "aaa66b6f-9b53-4488-a85f-5d2107218e6c", "comment": "Malware payload", "value": "38dad5dbfc291ff10af3af06093e5a1f", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411665, "uuid": "fc368ed9-5a50-4751-91ec-389cc22a375a", "comment": "Malware payload", "value": "ba7731b6dc348e539c3e92a30f7811579de525f4346b223430b0b668e68e30c0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411665, "uuid": "6a5351b9-8a63-49a0-9273-bc2934fb6817", "comment": "Malware payload", "value": "c98f1cb50a7e0980060e3d78aff5e7d2d1eb38cb", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411665, "uuid": "6bcb18cb-46f1-426b-a8a5-e692708ccac9", "comment": "Malware payload", "value": "bf10e0c5b829d9286852574b3be4d066dd81f11e57d093fdbd628fba1f5308b778030f020f1598eb8ec6093971b32653", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411665, "uuid": "f0f5a130-f541-4817-bfbc-4d4cac1c32f7", "value": "T13C34BE567250CA62D6854B314E9397D2233AFC69EEB782433344F73F3A77790458229E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411665, "uuid": "d16d6a20-b434-4070-bd18-91594d3ba641", "value": "6144:OxEtjPOtioVjDGUU1qfDlavx+W2QnAvPAJRm6qf9AhRG60sF:04JRm1fihRGzsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411665, "uuid": "ccba23a6-57c3-4d3b-bd76-1dcd635b7435", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411665, "uuid": "629db559-2123-4e4c-908b-fbe5367a5c81", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411665, "uuid": "dfc8086c-7097-45ca-9739-f2e8f80f1220", "value": "SecuriteInfo.com.VBA.Heur.Ursnif.2.F934D3F1.Gen.21585.20914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fcc55e-ef2d-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1627426538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426538, "uuid": "06649dac-3e29-4bd6-86f7-f76aaaf1973b", "comment": "Malware payload (RaccoonStealer)", "value": "a0e87c4b9483fae95f6f57946023d3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426538, "uuid": "29a66e09-e628-4589-8fb8-66babe6e4abc", "comment": "Malware payload (RaccoonStealer)", "value": "bb7dead4d3da28e16ef45d0019cd42bbd3c4e3454c3042867e7f64aee2439912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426538, "uuid": "1978fbe9-3fec-4492-8a81-71c0e3576728", "comment": "Malware payload (RaccoonStealer)", "value": "993ab6ddf0f3dfa349ef7ad4e3a44d0fc2a15a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627426538, "uuid": "75476d38-7ccb-4d3e-bcd1-9ff8b6e88548", "comment": "Malware payload (RaccoonStealer)", "value": "789a3133f1e847b52eee4b573a270a9e45f7cc232c27ad6e45132425640734da24b4419213de2eae25860cf4265f43fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426538, "uuid": "65f6c16c-8bf7-4475-9891-2c0fd38ef818", "value": "T188D5331D7F22DAABC1226D3245317BE187F13343354C9A6F5724A629ACD6F702D9EA02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426538, "uuid": "faeb841b-7e44-4f4a-a5a7-096df66161ae", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426538, "uuid": "89f26400-7bb2-4f40-8a74-7d977e95cad9", "value": "49152:EgGeCFEEIxWoH57jp49GfCZHw7DhSZ2eGIxy2FKVqrZix9zSlbtcUw5:JHCG+0Zja9sCZzZnGWdF+wZixpebeU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627426538, "uuid": "a53e080e-c30b-4740-942a-a011375c76d1", "value": 2916403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627426538, "uuid": "7dbd5f02-af7f-4183-870a-8a7ce73ebc99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627426538, "uuid": "17571ccd-79e6-4c25-8ee8-c5b4622f9991", "value": "a0e87c4b9483fae95f6f57946023d3e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1594db0-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627400712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400712, "uuid": "83a5705a-be6b-4da5-a19a-1cecbaf94f0a", "comment": "Malware payload (AgentTesla)", "value": "5fb3fc06922cf2e8d88beb2566b8a1bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400712, "uuid": "1e848a91-647c-4a9d-bb5f-2a8272c47174", "comment": "Malware payload (AgentTesla)", "value": "bb8f297b69b83f67d611e5d0fd966efc9116a79598044c02e9a691a30fb7c07d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400712, "uuid": "ad3217cf-6a09-4aba-bdcd-85de09319d8a", "comment": "Malware payload (AgentTesla)", "value": "8dfefde2ed3ccc6a27f3d5e3ad873126e54b0103", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400712, "uuid": "bd3119bc-5503-4999-8c21-ac76bedb2872", "comment": "Malware payload (AgentTesla)", "value": "7022154e4895b985d72fc73047963fcef09142d397248e4a212f2fdc336c3f666699fcc38ddfc0b8a8054f4919cb8765", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400712, "uuid": "18f7b510-8c81-44f6-b7a8-46bcc43db7a9", "value": "T16105CFF1052C7B0BF0AF0B7DA071409657F054EBCAAACBE5FB2264E79F25297104664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400712, "uuid": "12258be7-3d14-48e2-adba-024d6d223e98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400712, "uuid": "d96a62d8-01e1-433f-964b-7995e4d60e65", "value": "24576:h6DXSOsBgo0q4wMCD2KNq0yvz6o7DhuhAQ8TNM:h6DjoHMVKNBy76khuhAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400712, "uuid": "06d78d96-97d7-4607-9dd7-4053c082339e", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400712, "uuid": "30d1dc37-1c7d-4878-b6ab-607b05fc2382", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400712, "uuid": "2be99ee1-0686-4ec0-ab48-9545f9764e42", "value": "5fb3fc06922cf2e8d88beb2566b8a1bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bbbf61-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401850, "uuid": "056e89b2-a5a4-4d57-8eae-b6f4705c8168", "comment": "Malware payload", "value": "3367825f0fed491f93fcdd8200191b98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401850, "uuid": "56847c39-4781-41c0-885f-ff535ba3001b", "comment": "Malware payload", "value": "bb90a8e444c76e8d06148849701535bd57c37c50cc6a96237d660382369d4d1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401850, "uuid": "fa6f7d62-967f-4916-81e1-474fbb999273", "comment": "Malware payload", "value": "26060e5b061f019770352cdc60d3ffdbd8e75a22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401850, "uuid": "130698b6-a4ac-4471-8207-c51a9e99ead8", "comment": "Malware payload", "value": "c36125f95de7b10e7a9665a7b3e1b3a598d9a29702d4610ba8dabd12082e623849e4be29f2c966a93c820018bf0c2bd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401850, "uuid": "e8650711-97c3-4a6d-99c5-b5a7ea50f507", "value": "T19803E17A93C02DD2D703F13451921B234D6B0BAB75A3E8272604BD70575B4AFB8B6E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401850, "uuid": "b21be451-6695-49da-978d-6473a4513d41", "value": "768:pPWl1tts65ejmHID0LuNdLJJ9OuPZ6EQsi6BMJgGlzDpxYs8:Al1ttqqyXh0Ii6GVrYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401850, "uuid": "a5c5071d-8901-4d8a-bcb1-ffa89f921789", "value": 38804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401850, "uuid": "a6583e83-bba2-447d-bc1d-025c1e923a8e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401850, "uuid": "b8b0b65c-26ab-4641-9182-cf9da012ea18", "value": "3367825f0fed491f93fcdd8200191b98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761ed2f3-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627366280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366280, "uuid": "126911bf-d18e-46b6-bd71-6a85b18d2719", "comment": "Malware payload", "value": "9a375d9cf5b49dcc45a9e411658f441f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366280, "uuid": "4a5d4973-869c-4230-9903-90a8ee4dae1a", "comment": "Malware payload", "value": "bc57d17c06db8ab9f604efa0db30b35bc241018f5be46a25aad3ebcefc398753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366280, "uuid": "86767a6d-8c2c-4132-855c-81fb69528743", "comment": "Malware payload", "value": "fd59bab51ed7a4438ae59b71355b2b2551ab6753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366280, "uuid": "68a242c1-6bea-49f3-9269-45a202e27b3b", "comment": "Malware payload", "value": "7b50185c1afdf7e1f7f06fe48244329f8b974a99706aa65103dd3f8feb21e14749f9f80be8383df40b1c1191da485b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366280, "uuid": "23fd59c9-a9f0-4146-86a4-3cbb2bc8592d", "value": "T1D374E041BE84D05EF895C37299671AF31679FE782B4A4A83BF80FB7B1D715904C306A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366280, "uuid": "a3ade0e2-51e0-4005-92c5-dbd8826451a5", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366280, "uuid": "c4b8fd95-4693-484d-81c1-8d04832cfa74", "value": "6144:od53TvpHeIl0kL61OBmrs/3fqqL/RXFTSkL2bFOLLKliar2IIe/xMJwQglV357hy:od53TvpHeIl0kL6oIrs/C+ZXZ42LWiaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366280, "uuid": "a0cd8944-3608-4547-a5a5-ff071df2d670", "value": 361963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366280, "uuid": "3f031965-6ea1-40e4-af3e-333b96d909b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366280, "uuid": "011199e1-ba16-4286-bcbb-97065e395c42", "value": "000100049000TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb71ab5-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627399715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399715, "uuid": "cb9bd329-7e4b-40cf-a66d-56225e076b85", "comment": "Malware payload (AgentTesla)", "value": "c277827a2afe5d23f11448d75291342c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399715, "uuid": "49ca086c-d0bc-4c33-9014-897ef3e89d35", "comment": "Malware payload (AgentTesla)", "value": "be98f101070d1ef350f5d1768e640f5f23b047f890fde74495e49b9f6fa4d00b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399715, "uuid": "8b29da34-c454-4620-a478-4a72759fc4b6", "comment": "Malware payload (AgentTesla)", "value": "84528fcebd7c5dd3b118dad30bbb3ee30566f98e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399715, "uuid": "c8e0c6ac-acfb-4f7b-80fe-b1c280afc86e", "comment": "Malware payload (AgentTesla)", "value": "2748d86ebd64974e9e253759bca54a242add32b3fbdf3c5255833ef09b8aa702f62062ee1655862ae42cd381dbb80da7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399715, "uuid": "8fee37b7-3d73-42f7-b8bb-0e31057c6e64", "value": "T10EB42276E373FC42C8380D30A4EB19E65F596AC7661683CEC587B3CDA49B70081995F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399715, "uuid": "447b2399-5c28-433c-99fd-72a88492f026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399715, "uuid": "76bfcf4c-4cc8-4b88-9f6e-e720c8dd402c", "value": "12288:ja8cPBhXL+UMTOCqVbq6UVxlmRsP+oqjfCM:jMbFCdBmRw+oqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399715, "uuid": "5d3121fa-4e4e-459f-98ae-d09bf60fd967", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399715, "uuid": "ba3f553b-4a07-4aac-a78a-d76a18307314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399715, "uuid": "20d75ed0-1be8-4d83-92d3-f836570b6a04", "value": "c277827a2afe5d23f11448d75291342c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f676ce-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627384689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384689, "uuid": "a3767abb-f4b8-455e-ac6b-a439bbe02866", "comment": "Malware payload (SnakeKeylogger)", "value": "bf5debdb19350b5beb73576e30398a55", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384689, "uuid": "b7b9ec33-76d4-4892-bbbd-f4e44c4b51be", "comment": "Malware payload (SnakeKeylogger)", "value": "beba1b53cc5aed5341b78c6011cf16136218faa25d0a5ae6b9e2e3ce952f0d78", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384689, "uuid": "5338b4f9-2f5c-495f-a341-69895ac4425c", "comment": "Malware payload (SnakeKeylogger)", "value": "1f80881a755bd14742d3572c488c87f5b421f451", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384689, "uuid": "473f9fa9-45c8-4f60-b6e3-2f1ea2045fbf", "comment": "Malware payload (SnakeKeylogger)", "value": "1e3d852b7b898d1f5a9171e62558c850b80c62a7bfb621fc26f4232f926b4f449bb98e4181e100ad1a504346273ade71", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384689, "uuid": "aded3eee-b3a9-4cfb-8f28-86170401ec37", "value": "T1519423D26276BAF2E5DC507D8A2043DA69DC7FD6B056083BAE90E4E05E502D32F431F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384689, "uuid": "092599dd-4eab-45c4-9d1a-6965d23745d0", "value": "12288:WYr22WeNo04PDFlSxIbDhFIX+S1cHdZph95h/4:tr22RoDFlSq/hFIB1c9P5N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384689, "uuid": "4bf329d0-c7d7-465f-a060-7edfb9bd1bf9", "value": 444566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384689, "uuid": "ce8e3968-c9dd-4ba7-819c-cc1e42cfac03", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384689, "uuid": "9b90b94a-0ae0-4f5c-9dc8-e78ace697bc0", "value": "STATIONERY MATERIALS-ORDER SUPPLEMENT.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d897cb7-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627400545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400545, "uuid": "853cabaa-4090-4825-8c84-569b8771a5c9", "comment": "Malware payload", "value": "b365ebd34ae682f5b2d1550cf4c48c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400545, "uuid": "a5be6856-be20-4aac-a8fc-2bc3def8f65d", "comment": "Malware payload", "value": "bee1f1053416f4000d447778e3e4af188b3325148f7974d018bfa1c93e5bf9be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400545, "uuid": "95d4b25c-6ab3-4c3a-a258-8dee7b724834", "comment": "Malware payload", "value": "fa60f6481fdf78eaad1af8c67291cdfc68019a7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400545, "uuid": "311cc2d4-1f70-49c5-9631-97d435ca3ca9", "comment": "Malware payload", "value": "073b0492edec2fe9df172ab956b6d4beb180394132ff29cd34daa7a7d6b6d98beb61e4c8e761397580593bfc91aaa6af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400545, "uuid": "f32baf2c-b7f6-4687-b248-49e38a27fd86", "value": "T1AE15AD0427D88A5BF1FE67B5C0B392A1C3B1F451B93EDB8F5D4424EE1D1A7809A107AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400545, "uuid": "9cad5c19-84fb-484e-bb81-52a6669e9db5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400545, "uuid": "6cd1bcfc-e52d-46bb-941a-c68c45ee1865", "value": "12288:YFGu3AbJBdBS4msNUCe65frHMnz2R94S4KsfiSe6+fXHxt2Edp:u/wbbdo4mz1U8z2d4KBF/Jt2Edp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400545, "uuid": "db3cfec1-fdb2-4115-abec-7291710a2b66", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400545, "uuid": "6373d2fb-f1dd-4f31-b09e-3cf943a0063d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400545, "uuid": "4113cddc-e1e9-4a3a-9fcd-333010b35b03", "value": "b365ebd34ae682f5b2d1550cf4c48c60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea8a935-ef05-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627409083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627409083, "uuid": "6b791b41-e581-4ddf-86e3-e02ddfdd0a11", "comment": "Malware payload", "value": "59b10a4ae08a82cceaf918848c40a8f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627409083, "uuid": "2c3c63d1-f34a-48b7-a839-fff86472422a", "comment": "Malware payload", "value": "bf12c7cd5b7991644a86d6ab104040e6f51581d275a3f9e7f9b60e9931a204e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627409083, "uuid": "084ca0b2-c832-4358-a1aa-4f17220d30ea", "comment": "Malware payload", "value": "acf4e109eba29bc8ad37a4db9337ac9a30f74e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627409083, "uuid": "75991806-f340-491f-bf75-82a672fca653", "comment": "Malware payload", "value": "816cf5edf8554708f303185cd7d5cfe4e569ae6e4ebfcad9685fdd449367b63f61127d36a0e9c9d07b7c4665ece87681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627409083, "uuid": "4524a309-eb7d-4769-a7a7-2e26f8841e03", "value": "T16A057C39720DBB5AC5390A368B42E58B53E0DD0F77A1E1DF68C835DD2D23A25AE3E051", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627409083, "uuid": "61a1f420-d106-49a0-8791-6870e4b84bb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627409083, "uuid": "6c09b203-b420-4e30-a89f-e1907610c7c4", "value": "12288:C/hH4OOyHpBvygTUxi2W3uIgUtBEbRqh6axkX3Xj+EeQU7:C5YcpBvygA8E+BKPaOn1eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627409083, "uuid": "707aae88-c03c-4b83-a308-843005782523", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627409083, "uuid": "1ad9d1c7-579f-4c85-8c97-af5bedf907c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627409083, "uuid": "09f7dad4-180c-4c9e-9ccd-d19eb5313487", "value": "RFQ#-Airbus AS365-EC155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d847b3-eec8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627383162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383162, "uuid": "3325aba5-cbd2-4e68-abc2-39013c87ef9b", "comment": "Malware payload", "value": "25eb4023fba770092e7817c41ee2af7f", "object_relation": "md5", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383162, "uuid": "101ddffa-f69a-457f-a6a5-fdd2fb21a2c7", "comment": "Malware payload", "value": "bf25d7b400a7512ea948f5d98b39bf4729e3292f65dff05a289b779c25d23cea", "object_relation": "sha256", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383162, "uuid": "aa8e9151-dee5-4f1b-bda9-54702494dd1c", "comment": "Malware payload", "value": "9388e6a1a243555daa485892d2a4269d0827cab0", "object_relation": "sha1", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383162, "uuid": "9de86732-2616-4688-83af-ea207721aba5", "comment": "Malware payload", "value": "0ee914e6278ad967147f628dd59ddce32ee07d72c7ba63e43339e3bb1cab1eef0ef630da8be043160cd5f006c17cf97d", "object_relation": "sha3-384", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383162, "uuid": "46371173-dd68-4202-86cc-b044b8e342e3", "value": "T1BDA312A5CD9D80C9BABDCD14AE5E0061CCFBC4CB18BF11D3EA4D6D18FBA546CC61129A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383162, "uuid": "ba7cd4cb-48c6-4f8e-b61c-e4d7d6e93eab", "value": "3072:CNINhFRrqZepZsmWPPhRj4gvUpZ4/05V/:CXZ6spPjjRcpK0T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627383162, "uuid": "206c0c55-6b85-4fd5-a92e-e2da2f378f8b", "value": 98343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627383162, "uuid": "b5d32007-414d-4054-9044-e78e6e9b6cfb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383162, "uuid": "29372216-303f-4e36-acf1-8d1eb4110174", "value": "000122223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a26ab8-eef3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401625, "uuid": "26ccc7a6-56e3-469c-b09d-69abfece234b", "comment": "Malware payload", "value": "d9344c912365aabd84371a9af639f7d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401625, "uuid": "7919e414-b10c-4659-8876-1fcaef46242c", "comment": "Malware payload", "value": "bf8a6acb579ba856c81bef70a2a4d8050448fa341473893cecc21d0fa34f4f65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401625, "uuid": "1d23396f-c7dc-4d4f-877d-9dd91078d27b", "comment": "Malware payload", "value": "b57633c65e2589e00622eb589825c72ab4ce77ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401625, "uuid": "1859e653-f5ed-4e8b-99d5-dd20a3f9247b", "comment": "Malware payload", "value": "f90b48efa6a9aaa88b03bedac49aa3cb7d7f481fcb8108a00bb3f40bc3b2acc2b291f7483c5ca8ff4f59972f16dbefaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401625, "uuid": "c0005193-a324-4856-8a7d-9805de101dcd", "value": "T1F705AE2F214957AFC1A29273C514A700FDF2AC526621ACCD925BF28B4F1782B768DF1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401625, "uuid": "12d81176-987c-46bf-9531-bcb945b93df7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401625, "uuid": "d9ef8ca9-cda1-4fe0-951e-d9845dab8b22", "value": "12288:dmTPj51BvnZNkYEPME8+84ImgLtzwuJzZ8s99doFH3mLzjTBn/k8:dmTr5ty5JVlgLhh99OEzPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401625, "uuid": "668c3ca2-bb75-4820-8089-fb9d49d3d059", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401625, "uuid": "9be28b4f-6d72-4e2a-9ece-2152aa5ab61d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401625, "uuid": "32f31aed-b43d-474a-866f-c81f89867cd2", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f5bf81-ef14-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627415613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415613, "uuid": "c843e37a-d2e1-4be2-b90e-bafdf39753a4", "comment": "Malware payload", "value": "3965feca216cde849f987b614794b46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415613, "uuid": "98754e8d-fca1-4103-bfd3-8d549adbfc5a", "comment": "Malware payload", "value": "c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415613, "uuid": "d0384100-330a-47d8-8520-8a80debe24f5", "comment": "Malware payload", "value": "d5fd435edf3348930b1500d9b10b3b010b07ef99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415613, "uuid": "eb882813-b77d-4f01-9096-332c71d73418", "comment": "Malware payload", "value": "715d0339f9705e9c2e48ca69df73ba49988537d659cb4bd0157caabe672269aca90bc585d86a6a64d9d1e10c61b439c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415613, "uuid": "7a8bc283-fed6-4c9d-83f5-69969023cd97", "value": "T1FDC427AC315039AFD637D873CA64AC10FEA024A3A307CE079153159B5E0EA57DE4DDAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415613, "uuid": "0521471f-6f16-42aa-862c-7e2b50c11439", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415613, "uuid": "be950de5-9125-4f06-9c70-74df0a7e520b", "value": "12288:aJn7M6BUy67/Apk/dfxdYo9N40hSD91WlT0M2emdiwulfhTVFZ+lF2y:aJ7Mz74kFfPYo9xhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627415613, "uuid": "91767791-1b6c-435f-b910-a3142256b687", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627415613, "uuid": "51527841-0d6c-43b5-9d07-f7417c9a23dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415613, "uuid": "03dd8ca4-0562-4a57-9cbe-b2101ce0b2b1", "value": "Detalles del banco.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c92ab5-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627396663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396663, "uuid": "c273fd78-def3-4552-88a7-157978ca509d", "comment": "Malware payload (AgentTesla)", "value": "66dd7813d08a65abe076c78f3b2e2699", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396663, "uuid": "4d9abe64-5d22-4bcf-bd25-35625435533b", "comment": "Malware payload (AgentTesla)", "value": "c1a3563931fa2243d1ebb352779d3d94869ee26a38c87c257c2a02022845986a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396663, "uuid": "7a72c504-d929-4803-a1ff-703c96e5d918", "comment": "Malware payload (AgentTesla)", "value": "cd2a9026496865e395723ccb68a39fabeed06f2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396663, "uuid": "e6823c5a-4dc9-4a23-9579-2761e0d01623", "comment": "Malware payload (AgentTesla)", "value": "74eb7aaf3ffb1d38cbbfa47a445b16bfbd7706475d0be440390484e6a4b2f72a0f8d71deed30fa2d73c1f56d9dfb7323", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396663, "uuid": "6daf7dcd-ba8b-468f-b4d0-c43cec24a8e6", "value": "T1DF71E8291EB8ACD1CE2748E6E4B9F81902D6FC4953C74AD2F02EF5B027223269301845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396663, "uuid": "b64932aa-8dff-46ef-b730-746ace61200a", "value": "96:5bIDQZzCqHQJcALVadP7PI4T6kQUwal/S:1ID8zCtcALVadPE4mkpwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396663, "uuid": "9824b74f-74b8-4577-9928-351d7c387149", "value": 3804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396663, "uuid": "5ddacb84-9f63-4df6-9a1b-fa27148b7044", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396663, "uuid": "155c9eb9-d161-4493-9694-af1447c47517", "value": "PRINT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18342eb-ee81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352636, "uuid": "a91feae7-b5ba-411d-b23a-97b2b6e485ab", "comment": "Malware payload (Mirai)", "value": "c73702f40ae799464bf0536c0f5efd86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352636, "uuid": "8a756cc7-f6e7-4fba-9399-880839eef194", "comment": "Malware payload (Mirai)", "value": "c1cf89f5ca3f51305cb0e87feb2c3f2b77db34fe94b80fe0ed50c1493a05c259", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352636, "uuid": "137fbae0-31df-4d6d-bb32-8b613a71e7aa", "comment": "Malware payload (Mirai)", "value": "2714518c3af6a04344833c3aa15b4007e1ff8fa1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352636, "uuid": "90c3ffa9-cbf8-4e67-b340-9f8396feb21e", "comment": "Malware payload (Mirai)", "value": "381515968f063dea2849c911af8ee4afd0a58228922cf2c92211b07b13d7a9f6c402376f59818e977c2dd44faf12a61e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352636, "uuid": "e92207ee-a7c0-455f-a2bf-7112a0e9a6a7", "value": "T15D634BE5B4029F7CF44BDAB685270909B532A2454A930F2BE373FCD76EF21948957C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352636, "uuid": "1ce405d0-0014-4d50-a46e-ac64a06e9101", "value": "1536:bsH5IE4vIS2O0u29SDziZv+WLLNKeJY0jIbUHMI8IcDY:bO20yzioALMc8Us0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352636, "uuid": "f68559d4-8d95-45f9-b9c8-840d870ce270", "value": 72388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352636, "uuid": "8762f78e-186e-41b3-bbfb-e7e790333ed7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352636, "uuid": "0de651bd-fc9f-4c91-a361-b4d7fcfa3759", "value": "c73702f40ae799464bf0536c0f5efd86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88501ce-ee94-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1627360808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627360808, "uuid": "ff517c86-cd0f-4b8f-a13f-22ca49f1d601", "comment": "Malware payload (Heodo)", "value": "26e3347712427844c474f75785e7f462", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627360808, "uuid": "402d0fba-f0de-469c-8269-58d6e987ed6e", "comment": "Malware payload (Heodo)", "value": "c1da418ed3eed2217c5e86c26b9b68f5451b14e8f0306538fdd11af5c8e2f2ae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627360808, "uuid": "2a58d3c1-aada-4195-9f1f-befdd4cd2cc7", "comment": "Malware payload (Heodo)", "value": "742e72824b36594fd325ef18baad5b351f49792c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627360808, "uuid": "bd65ad8a-030e-4f8e-bfb8-f1f2ea4959e1", "comment": "Malware payload (Heodo)", "value": "6578000f2e215842d549ff53ca5411ed0279310fb3ba096143806acbd6cffb48d67bf2e2f31459f0a5d5648af5b3f9ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627360808, "uuid": "6b69a58f-7ef5-4ca9-9ee0-82b933187f80", "value": "T108E2E7381AD90735CA9E4AF4C4E35210DB3CB3B38853F76E09D808FA2547B6DC9163A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627360808, "uuid": "036e08c6-ee2d-4466-a3d0-d6629c884cba", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627360808, "uuid": "c8ce3f90-81a4-4965-9377-11a022447a7f", "value": "384:4Du4PSwONhvC0REXKAE4kSrsmVkFEi6oAxXv2t8ZtXDnkS2RbVmwVAZYJbp21nxw:j4qw6a0SahYrs8u888HDkzK8pGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627360808, "uuid": "2f754966-3aec-4763-abfb-3ab92c034fc1", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627360808, "uuid": "bbf5be4a-efc1-41ba-bd49-03d11e327b06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627360808, "uuid": "425cda0c-360a-43d4-9479-4f54013bf7e2", "value": "c7157a26-34b4-4dee-94ce-7cfedaa3bb17.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce04afb-eee9-11eb-875b-42010a9c0053", "comment": "Malware payload (a310Logger)", "timestamp": 1627397027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397027, "uuid": "27df5759-9326-4685-b248-e38475d106a3", "comment": "Malware payload (a310Logger)", "value": "504699e285d084cde86b629e0068c163", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397027, "uuid": "4d7c3e82-9f60-4de0-8553-8ae20be2027c", "comment": "Malware payload (a310Logger)", "value": "c2c95083fed4828371535c582e16d6304222636a7a5df01bdfb832f68478ffeb", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397027, "uuid": "d929bade-8852-4dfa-99f4-7691b24e9887", "comment": "Malware payload (a310Logger)", "value": "28be3633528d43d061473e9b126f00f847d69670", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397027, "uuid": "452ad931-9afd-4431-aee9-9b07054a72c0", "comment": "Malware payload (a310Logger)", "value": "6904e4c5bb0e292a525815540a9395465e94f0f54e355d3eb357a0f6c39ee4fb965a3a77b98f9cea1fd1b6bcac7db829", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397027, "uuid": "bb75ce81-e928-416c-8e7a-9f04dd2d7716", "value": "T1925512167E6C4FCBDCEF2C791FA1522754FB6D00A90806667F887F9620BE1D851AF206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397027, "uuid": "6d3fad34-ca5a-41cd-8f40-8d32806ba433", "value": "24576:Z9v8mQWqlUR7CfYH5RUR1SKIhH3evMv+E/E3E0tVfnXJBuocITmIMm3Ms:ZR8mTql/sfUR1SXhr+/U0ffXJdbbMm3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627397027, "uuid": "7acfe2b5-1f6b-4059-9772-29ac3d96e17d", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627397027, "uuid": "71d31b04-c3ec-485a-9435-b92adbf7c684", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397027, "uuid": "8dada009-3985-468f-b072-ae56128183bf", "value": "payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a8430d-eeb4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627374626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374626, "uuid": "1046027e-0616-4134-90e1-bc4e12e76f4f", "comment": "Malware payload", "value": "a8e17b6252ed7e3c9bda4f55b2e3cac9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374626, "uuid": "04363a81-b75f-4126-ba01-72abfcc1d3d2", "comment": "Malware payload", "value": "c36c266157d4e7b7b2dbc36d96bde0086e31647b541b14db70d9fe1e36bae779", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374626, "uuid": "4a1371cd-a3fc-48f2-90ad-f89a2a4f6a3f", "comment": "Malware payload", "value": "e70b1dc096fdce51c240d02be32dea3c6d3ce2e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374626, "uuid": "db2afed6-4a6e-47af-8313-c183cefc482e", "comment": "Malware payload", "value": "be556d01d0284095eb9d7a305c2d661992f3100230424c97ee9eda6944ed9b6fd4d6e500e2488c6be65c95b00d930ece", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374626, "uuid": "6f35c2ca-2d3b-40b5-95b3-3a31420992db", "value": "T1413348D867D0F80B638D3E13FE4A7AE5D0B6685794E4B90FD244BE4C24B9217C5A0EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374626, "uuid": "b5b88687-d038-4cd5-a947-1f200d252129", "value": "1536:6yDjzIU6S7wMYO9noQlgOAt0kO8MifOSPPwHgYZSoX0:lDjz76SPYO9noVOAt0j8MifOSPPwHg+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627374626, "uuid": "949c9de3-99f5-47ae-8864-9e2be7b50d82", "value": 53939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627374626, "uuid": "f418612d-2a9c-4692-b31e-4442e547ccb5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374626, "uuid": "f647dc19-9452-4d45-9bae-2016d83ab455", "value": "docs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a088edd6-eed7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627389544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389544, "uuid": "d20c8b1f-4c7d-4a7a-a8ec-7cd880808d09", "comment": "Malware payload", "value": "be629abcb4d47e9a96d07b0f12a83803", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389544, "uuid": "c47a4809-8a97-4e4f-9931-248e565a33c1", "comment": "Malware payload", "value": "c4379796b35d65d0589710688f14e01c1c59658299c8e85912ad6bbe17cd9a7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389544, "uuid": "4bf21944-30ae-40dd-b558-9a000506a9d1", "comment": "Malware payload", "value": "5d1a0716e1343f08cb6f11493e846618e7db7900", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627389544, "uuid": "6ec5ac07-62e5-44b6-9115-673b8c0bca36", "comment": "Malware payload", "value": "385dc0b83531671c35b2336ac5f591200bf858e23a9966205f67565446265427da686e9cdc5de19995f4e53083f0242a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389544, "uuid": "c40d08de-f76a-4bbb-9ec4-ed1912686785", "value": "T10644BF68A7FD8726E6FE377E287582144B34FC63A476D70EAA4040DD1E627418E50BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389544, "uuid": "a912a606-c284-4efb-a064-5bf6d806f2e8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389544, "uuid": "466e184c-031f-451d-bef0-3a9591f8926a", "value": "6144:Aiy9nKGJFKOOTUK2ao9ARwDrMiM9of240x9r:7hgFK/UqWgmrMqir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627389544, "uuid": "bf204a42-2d61-4f63-8c31-78fc0efe4824", "value": 272084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627389544, "uuid": "44a40d70-05d5-4adb-b568-8ea30ed0c56f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627389544, "uuid": "daa8de2f-9abb-4645-a873-efe0ae8436ef", "value": "SecuriteInfo.com.Trojan.Agent.27695.7013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4b6803-ef04-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627408654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408654, "uuid": "36df08c5-6296-4455-9128-3e7b33a83c17", "comment": "Malware payload", "value": "427992e6cc9f399060c003ae46389403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408654, "uuid": "4798989a-78cf-49c7-936a-b7a7203f3b96", "comment": "Malware payload", "value": "c441b0de54cee442566129507b4f3f0dbcbe6eb42ff24936c6e180a3d93fcdb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408654, "uuid": "49e344dd-84c4-4225-b492-bfcf4e9bd79d", "comment": "Malware payload", "value": "07cfcd1b19481ddf586f4b84a1d4a6aef2da722a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408654, "uuid": "8a0e00eb-004e-45c8-8692-cf14dbcda20f", "comment": "Malware payload", "value": "c29295d9c114e4e73ac386773f0c33c0958b42581a80dcbc4140435d0bbbb80de7288d4c2ef0cc4d9bc9cf8dc6966d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408654, "uuid": "47de9ad7-0809-40fb-900f-2404d0650ecd", "value": "T1B705AC3814A84A67D67992B7C525A340FFF05DA67240DE0A4ED7F8C32E127431A9EE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408654, "uuid": "62888409-c6b8-47d2-b897-93847f343cea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408654, "uuid": "6003527e-e4e0-420a-81c1-541a35df4997", "value": "24576:qrEb2grO4+yKPoJHZ6gLl2FNY0wxOSkMoXww:+Eb2FyKI5wNVwxJk7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627408654, "uuid": "99edf6ad-c5fa-4084-940d-66fa2279e1d6", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627408654, "uuid": "1f62172b-dc66-4b25-b89d-53bfc26dc882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408654, "uuid": "bc7e8015-1c97-4644-8c44-2644893fdfb3", "value": "TT Transmitted Copy TRVTT2127468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14806602-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627365257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365257, "uuid": "7135c474-4cd2-4e1a-a67e-e1c7f64f1257", "comment": "Malware payload (Formbook)", "value": "f91a66d080744b9e8b946984d6d747c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365257, "uuid": "3d6aa07d-0b9f-429c-b7bb-e195598799d4", "comment": "Malware payload (Formbook)", "value": "c6a1a1a68b5faac43930deeab9cd6745bde62869786e21e0681b3dc0973afa80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365257, "uuid": "62937593-61b5-4fe4-afbd-45c5736fabc6", "comment": "Malware payload (Formbook)", "value": "886580b7e7d7f27135d2c9981770a2a59332e680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365257, "uuid": "f333bda1-402e-4f50-afdb-c523b91070db", "comment": "Malware payload (Formbook)", "value": "609fe709a8ec25a764a598d63b4a5476125bfb1a6c8d3f270bc0a4ca0e57791903795673fb658556b3ed12a26b777057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365257, "uuid": "19e390f5-022b-4c2b-8913-b86f42acd609", "value": "T19D25382439FA502AB173EFAA4BE475DADA6FB7733B07645D109103860723A81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365257, "uuid": "4d4b821b-6466-4943-83b0-91ba4ee8928f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365257, "uuid": "5bf275d9-a48c-4dc6-b254-11d69c3bde88", "value": "12288:p1baMm92lXt74Hu+sYq46e++BJETV7MSDPlGRZz/mnk4zQIL7cQGB3gVIZlH3pmB:pBLN4rpaJye9mjs2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365257, "uuid": "d13b7bb6-a0c5-4f00-81e7-f236efb1d1d8", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365257, "uuid": "78cb0987-12f2-4234-8f7f-377239f86557", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365257, "uuid": "dfa02afe-9fcb-4e63-bb1b-ba4fac9e846b", "value": "Instruction copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4d5674-eeb0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627372679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372679, "uuid": "bd157c74-dc37-4fe6-b87f-ac9cbeb13d58", "comment": "Malware payload (Dridex)", "value": "84dfcbf8006b609714e14ae85d94baa4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372679, "uuid": "a5efe263-4b2f-4969-a5aa-d3a43e095a39", "comment": "Malware payload (Dridex)", "value": "c6ec076b4821de409d2fa1416b8419635421b732960a62e62bac6161040ab342", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372679, "uuid": "a803eef8-ddb9-4a1e-bf62-337f04e48be2", "comment": "Malware payload (Dridex)", "value": "3cbd6c0a05e587d0ebcb46c125bcb9a31814865c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372679, "uuid": "0738153c-9453-4b8a-953e-1e16291117d4", "comment": "Malware payload (Dridex)", "value": "12fdbddecf0c1f4e203785294db91e6fd7773aa5c7a8cdb8fe72a8daa93bf685a281eb9499b8ddf2526db97b3a454bdd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372679, "uuid": "399ab49a-99b0-42a9-9149-93a48200e8c8", "value": "T13D74129CE076C5DFFE07207A79811FEB8753382796E982B0E320616DC421F6ABF91156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372679, "uuid": "836993be-ef5b-4491-ad87-f047ce641372", "value": "6144:2vj+sWRo6tcJhv7Bzg+8h6F493OzNStilCn5VbwZImA5fmvYw:2b+Zenzdl8OLzNStV5VbwZImioYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372679, "uuid": "208c0437-e6d5-4ea0-b9df-2ba199e02283", "value": 342790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372679, "uuid": "577d3169-4302-4c58-9dae-7a9023bd503e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372679, "uuid": "a8806fcf-788c-458a-a31e-6873269d962c", "value": "Invoice_94145565.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63fb978-ef09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627411163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411163, "uuid": "d1de13aa-9960-46d5-babb-25fec1c4b3f5", "comment": "Malware payload", "value": "bffdd9cd36219573c7ce395c4354c11f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411163, "uuid": "7c7f20d9-d516-406c-b907-54c0396e355b", "comment": "Malware payload", "value": "c71181fdb516ea252684c3a41faa1eb8099ee23af7e1ea4dabc711d53445e86f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411163, "uuid": "d71e078a-fc8f-4a56-8e38-505dad7514d5", "comment": "Malware payload", "value": "6e40afde1b8387352a45a920a7c5cf0e751c075f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411163, "uuid": "4dc7afa5-3d13-47d9-b97b-0b5f39330f86", "comment": "Malware payload", "value": "db3eb2c5f8f812874e4e3c4f9234e5d88307d3990e165cd7cf051dc132c4c4f17b264f5ea149fde0497fc619eb84c885", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411163, "uuid": "4e55e76d-e73b-49b5-a899-3d59d6f51749", "value": "T1F1F2F243133B0492CBF60DB5F8B9868632A543FC5D16F3A36318126A4D7A4466CFA787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411163, "uuid": "00ea0733-d443-42e5-aa9c-5a338d0ca56a", "value": "768:SmyN24ozsM+3u5g0VHtqabctFFXM5vdiSC7/a5x5uFAz7SBy+13UA:Smyw4ozccHNqab8FFXW5Ws4Gz7SBy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411163, "uuid": "82e93eb6-fd81-4c00-8f72-569ffc3499c8", "value": 36444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411163, "uuid": "3c0395d4-c283-497c-ad0b-f7b32af3ff9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411163, "uuid": "b3a012a5-464b-4c20-a958-f61bfb96677d", "value": "bffdd9cd36219573c7ce395c4354c11f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c1763c-eeee-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1627399450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399450, "uuid": "6c8c27c3-5801-476f-84d1-e8839af2c900", "comment": "Malware payload (AsyncRAT)", "value": "8a7246cc77596aa840c15b3ac9907c4e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399450, "uuid": "bb9d18a2-b078-4f8c-84e4-f8a71c865cfb", "comment": "Malware payload (AsyncRAT)", "value": "c7be7d6e94c31e0f376d1cb9be3e0f311d57ae1a318437dc7c28b2574a73be31", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399450, "uuid": "e1f550bc-b31e-417c-a8e5-3a96e18e8592", "comment": "Malware payload (AsyncRAT)", "value": "c34f30b5aa3777cf3b3d35cfd8af330f8af97981", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399450, "uuid": "833f2be6-9e06-4fc2-bacb-3ced2f9f4445", "comment": "Malware payload (AsyncRAT)", "value": "984ef2829e9ef3fdaa1ad6362d3bc56729380119ffe6786bf6e144dcf40911bfdc1608cca3752e624cd11c224c8348c2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399450, "uuid": "e8c5b305-9270-4442-960b-903862b7314e", "value": "T1EC01102958ED5446D3C2D9AF02F5046DE803B325B70C203E64F1871B54A26610AAFFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399450, "uuid": "82d3fcda-b745-4de1-a352-2ffe7356c635", "value": "12:iRCt/oohRxbMEno+o+/9+iM9+DOOyv24Z9+vM7ITkSSsannGROWCR:aCBxJo+hMpOSLa9TPSsanWOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399450, "uuid": "8319e124-55e6-47d9-a693-81688932a687", "value": 730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399450, "uuid": "e8933f4a-74d3-44bb-919b-04b5d7876cd5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399450, "uuid": "5d118ca7-c913-48ad-8214-f79b5e2e3a55", "value": "LKGFCV.vbs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb955e9-eeeb-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1627398045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398045, "uuid": "449a8950-e12a-4145-b067-5072e73e15d2", "comment": "Malware payload (NanoCore)", "value": "d9b7fb50628a76fe7603d82f6f0c0bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398045, "uuid": "549d6b56-ed82-4c4c-86fc-0de99ff5eaff", "comment": "Malware payload (NanoCore)", "value": "c8d57922491f40b0c3e2ea9b0aff04df0de89ae9a6525508868134d1caca3113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398045, "uuid": "4669f08d-d916-40e1-8c5e-ed1f429d7af0", "comment": "Malware payload (NanoCore)", "value": "019ef807727684992fefd8dc47bdcc2593419389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398045, "uuid": "a558ef08-5dfb-4085-a495-e656191072a9", "comment": "Malware payload (NanoCore)", "value": "381aebc7993932452822f5783b0d15d7390476630a437f8405ad1972a41984e6adf059e8898085cc5ef5377e81c51916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398045, "uuid": "888dba3f-4c33-4e59-b20b-750b165420ad", "value": "T135B47B3815A44A23F27AE6F6D120E200FFF05AD7B201DE1ADAD3A5C71D12713659EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398045, "uuid": "c6267f4e-ebb2-483b-8859-f0f8a2fc014e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398045, "uuid": "f844659d-19d5-4b90-9751-9157896e5354", "value": "12288:xxT5mcwXp7UIUVH+YwADGWxGASxlJDxbpKdr7Gh:xxT5XwXp7UIUVpwfWQASxlJlQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627398045, "uuid": "cf08c5eb-10fb-463c-bc98-56eea495ae1f", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627398045, "uuid": "fde69e04-dc7f-4307-bbea-3b5190367f67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398045, "uuid": "7b8d5a15-09ba-4c78-ab4a-60965885aea9", "value": "d9b7fb50628a76fe7603d82f6f0c0bd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe2822e-eec8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627383147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383147, "uuid": "e642ae3a-f411-4517-a532-94e2de7c5049", "comment": "Malware payload (Dridex)", "value": "998a996a2371923b05250adc50f2c88c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383147, "uuid": "2eb0e92a-82ac-4b3a-9462-cbb6df2f643c", "comment": "Malware payload (Dridex)", "value": "c9843b6e4015374ff8049d9f0fed174a1aa690d7da3cb459922eae885006184a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383147, "uuid": "bf10a896-216e-43f5-8c0d-49c87708435a", "comment": "Malware payload (Dridex)", "value": "5dcff5955a7d6f0d5cb09074663feda9e8b6fe83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383147, "uuid": "393bd21e-1e53-454c-ad8b-d1fae6c06828", "comment": "Malware payload (Dridex)", "value": "721595a538604e64f8de1977c2a17fbe533070680bb1a0086872bb06ad360ae7dca42c19d0cc9eb24a2d5d045d8548f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383147, "uuid": "2f76b530-32e1-420f-90a0-efe795cc1900", "value": "T13B93E18E3ECC3E08D1B584BDC1A92D76C74FF0A2B41D650B1E482AB873669C237EE555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383147, "uuid": "ad074771-cc21-4e14-a16d-7409b1022b40", "value": "1536:/q2HXldvrVMkQpZjXCTODA+waU8DKSda6IdYnHEGwayi2L7jVlmhKwXy0EeEdECd:/q23l8kIjksFwaU8UNBtLP7mhrSJCCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627383147, "uuid": "49fa372e-4af2-42a9-af50-be924a26922e", "value": 92110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627383147, "uuid": "01d8cf7f-75fa-46a1-8283-efc2651b55bc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383147, "uuid": "29821deb-122c-49ca-a34f-0f01933cb6b6", "value": "SecuriteInfo.com.VB.Trojan.Valyria.5105.12283.5313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205ae0f3-eec0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627379450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379450, "uuid": "2abf2add-47d0-485c-afc3-9cdf2a88163c", "comment": "Malware payload (Loki)", "value": "fbce581748b0bc085cf3742c7f4e5859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379450, "uuid": "f17a70c7-5229-43cd-b2f2-60345459bd1a", "comment": "Malware payload (Loki)", "value": "c9f200f2d880906c47c6a9c36a16b7a42851e62b27d531f7066651b6932a7aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379450, "uuid": "98e2b300-5f22-4433-a6f3-afb331279b4e", "comment": "Malware payload (Loki)", "value": "a624dd7766eab090e47ae0d97de8d7ef2dd0440c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379450, "uuid": "4bc18864-1bd2-4464-84b7-667fe5268eb6", "comment": "Malware payload (Loki)", "value": "010394ec4d3e675e30bd2fc334a21ddc7e66148e06fe1aefd08f56a4206c2325d0dc2820a325b855d07b344a6b9b95c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379450, "uuid": "2f00272e-e268-4e33-a7a0-e19ca53532b7", "value": "T192C48CF831A937DFF44384BD5C707CA2295024EAC92ECF52EB23519AEF1C497952069E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379450, "uuid": "077b049a-291b-4cf9-87cc-f30aa25f0a95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379450, "uuid": "fea3e3dd-91c8-41d0-ab07-62a24a55e157", "value": "12288:Xpc/L+dnIyWF+0TY5++W0BjCviL7VCsx+cvRZM0AL0Z7mo5oFCEkv+:XOD+xI7k4z+WGJdCdu7mo5oFCEkv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379450, "uuid": "46ea8ed5-c879-40aa-936f-666369d3212d", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379450, "uuid": "c305aa2f-b642-4764-9d03-550e0d60aae1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379450, "uuid": "ac91ab87-e69a-46f7-b0bf-136f76c5066b", "value": "AVH3viH4ec3ZkIM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e92a92e-eedb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627391205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391205, "uuid": "635c4bce-14a3-40f1-8b1f-8cb568bb75ce", "comment": "Malware payload (AgentTesla)", "value": "eaed910ec2f38b480c809a8ddda95b4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391205, "uuid": "06957dbf-3be8-4911-84b0-f39fc07a7780", "comment": "Malware payload (AgentTesla)", "value": "ca007259e84050359f90079e2dd6d6ebde31872f64f65fcd47ce01531e7b6bb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391205, "uuid": "f6ea98d9-0bf0-4081-9c29-8050efdfed83", "comment": "Malware payload (AgentTesla)", "value": "c6944445e143600f3a63f6cd2d3fb34dd8a2e48f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391205, "uuid": "d43bad00-f3b1-411b-a410-40bdcd5f6402", "comment": "Malware payload (AgentTesla)", "value": "9620379cf336fcbe0a875f90e3b08438e4786787db1690b36ac24a5786c538e62c7878ff0176ec11cbb917d4ec8c3bb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391205, "uuid": "5e9536b9-41e4-4b08-ac83-211bff6a5ccc", "value": "T1F0D4487C355035AFD637C873CA64AC10FEA024A3A307CE079253059B5E0EA579E5DEAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391205, "uuid": "421209e1-da16-4f38-afea-079c093a9d93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391205, "uuid": "9daba365-e73f-4fda-a7a7-dd683ed9f00b", "value": "12288:kzsm17xPfJgbU7DuVDY9EEMNHJ8KpxHRtlVhGlGn7deT1Af7:kzsSnJkU7aVk9ELNp8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627391205, "uuid": "3e33f63f-ebdd-44fe-bcfc-befbe1ca0656", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627391205, "uuid": "2e7d6c40-bd53-4b87-b858-08d2598c0974", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391205, "uuid": "458550a2-46a4-4622-942a-bd396db7e51c", "value": "REMITANCE ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe6e59f-eebc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627378081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378081, "uuid": "e20642d0-c3f6-4b26-8da1-eebc48824e17", "comment": "Malware payload (Mirai)", "value": "4cf2b52de14a1e309ce59d1985ea2f2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378081, "uuid": "1f725691-3d44-4a0a-869b-05c5e5706537", "comment": "Malware payload (Mirai)", "value": "ca9c580dde4f0aa5b8e07c390ad887ceb498cfa81bdc2855bbc7b2240525d171", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378081, "uuid": "c84722a1-8201-4a04-b647-429b9bbc59dc", "comment": "Malware payload (Mirai)", "value": "27b4a3d78e13b62448e35aad81ee7bf3684476d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378081, "uuid": "d82361fb-2994-4d92-8e05-d74946e5d7ca", "comment": "Malware payload (Mirai)", "value": "cbccd10e13dc9c6c730f79be86fff8f3499433bf22ff115e4d562a197fdb3ab53916d854d73eeb92b31557f6372cd7e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378081, "uuid": "9bebb503-c73c-4ffc-9360-ea0b0965c527", "value": "T19003F656F8D28E1BC5E012B6BB2E529D3361B3FCD2CB3703CD145B047ACA51A5E67A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378081, "uuid": "554b5e3d-bdf0-4891-a328-680ba3feea27", "value": "768:KSgeNxflXo92baomAaWmkywuMEcMONMkeQP+dPhW/FdUN:lNxfl4Q/mASME+MP4+dpWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627378081, "uuid": "fa72d435-a9e4-4bb0-9a56-d46a79ec8af2", "value": 38180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627378081, "uuid": "0a22f5e9-2be5-4fb5-a5ce-a49968bc1bcf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378081, "uuid": "03b16940-c46f-4929-84b0-16836a40809e", "value": "4cf2b52de14a1e309ce59d1985ea2f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b67f9d1-eebc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627377831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377831, "uuid": "4a6ab8cf-cb51-43cf-8df6-13a1c835f9e2", "comment": "Malware payload (Mirai)", "value": "b6dfceb3aa281308c4686f762268971d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377831, "uuid": "af7e8633-6593-4de1-a6e9-d9bb11628200", "comment": "Malware payload (Mirai)", "value": "cc424b54005283d8cdde97e414f79759f8fc6f27a8bb92205d8164c2ee289835", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377831, "uuid": "2c542efa-af62-42ae-8fe1-6f91e09245e7", "comment": "Malware payload (Mirai)", "value": "ceb2adfec6409e8245b72bf41034349bf4dd0de5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377831, "uuid": "3093c0dc-88ec-419c-98f4-8618db95b707", "comment": "Malware payload (Mirai)", "value": "a0a202674ffba23c0fc2eff1e8f89a1d8c7bdb7185129980ad4a2899da0c61e3a613417df73652a025561971c58571d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377831, "uuid": "788b3542-5726-4be1-aac8-154beddff85a", "value": "T183230885F98B41F5C41B4C30A097F63FD732E62A4031AA6DEF9DAE35DA63701520729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377831, "uuid": "11218df2-39a5-412b-bf96-53ab23ca7ab7", "value": "768:CrGGfxqBKzOheyNAVHV6mTeET4xVYQAUyNS+tmdonNqsXGUYg:+GUccz7kwTLSM4+SonN3G7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627377831, "uuid": "d4054e79-9df0-491f-862a-f87a9221d13b", "value": 46320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627377831, "uuid": "9ac65479-7da0-4dba-a5cb-f9dd2b28df65", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377831, "uuid": "7972abb0-85c0-4a34-b2dc-3206f1c1ec85", "value": "b6dfceb3aa281308c4686f762268971d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60c7548-ee6d-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1627344026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344026, "uuid": "c0a9a9ea-973c-4efe-8943-b985101377ae", "comment": "Malware payload (CoinMiner)", "value": "cab63b06017beec8efd11d7f03ca5a85", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344026, "uuid": "0103a7fd-3b71-4568-8f81-4f30dd1171dd", "comment": "Malware payload (CoinMiner)", "value": "cc6611635ca61701a1aa303698270f8e6d8de4f6fc5e6b3a11c5fa9cb1621972", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344026, "uuid": "28fb1918-2039-4695-b225-4ed08dd4f948", "comment": "Malware payload (CoinMiner)", "value": "4f252e828d51bfe8cf1322e6c18656a8a9b359e2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344026, "uuid": "41e00e51-ac34-4ee7-8bb3-272d39ca96ef", "comment": "Malware payload (CoinMiner)", "value": "132247b7807ead7f2bdb0a4b62fb21546dc4eb5b2dd788f5efdc740e611928df38cb00c2a0af9f47344212fdab0f8161", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627344026, "uuid": "838aef63-1bff-4b13-9497-7398bf3fe8ca", "value": "T1F3A3E14673A6E411D9090932ECE3CBE93AB4ADE0AD018B2FB581BB1F2D307515D625EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627344026, "uuid": "cc62fd3d-5919-4c61-bb05-eb64bcfc79ad", "value": "3072:kwWI7JE7j41QqqhH+hFC/tu7NF9ETWHQbPRyZ2pP:kwWvp+hMlW9f8AZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627344026, "uuid": "6008b606-d1d1-4745-9511-dc3dfba0c430", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627344026, "uuid": "b99a8181-8fb2-403c-8dd5-d2f59bd9a8c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627344026, "uuid": "8bf7f021-d2c0-4cc0-8e9b-a1e0f35f60e5", "value": "cab63b06017beec8efd11d7f03ca5a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8447f4-eeb5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627374719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374719, "uuid": "8f2a5d58-583e-48a7-a38a-b26d32550fb1", "comment": "Malware payload (Formbook)", "value": "189b59d65940724d3febd8763d929c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374719, "uuid": "ec5ec624-3c51-42d8-8b05-7a7d502bbc32", "comment": "Malware payload (Formbook)", "value": "ccaefd526c1b30f67694ea01efb7bd5c794859ae01c68001a3d92e3d1dced67f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374719, "uuid": "2e2745d8-3b64-46c4-ba37-05d3fa8280f1", "comment": "Malware payload (Formbook)", "value": "e2981f344bb3f8ce214a609932bbc1525ffe6609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374719, "uuid": "5f357372-2f44-4999-8461-dc0ff4f225f2", "comment": "Malware payload (Formbook)", "value": "bcb48c0207b3b15ede8126e1e34eff289c24fb881ebb77e51b99eb7ff6a43c27b9e67ebce0e7b5425f58719e62a48038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374719, "uuid": "c781bdb8-7d16-44ed-841f-26e0fc4ca8b3", "value": "T12893005020307030E55206311601F4AC3E28AD33DDABAF4964ABBEDFFBF495A5DA94F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374719, "uuid": "7dd44658-4fc3-40a4-9ef3-c344dc4be9ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374719, "uuid": "f18a9135-3a25-4fae-aa70-589194992a7c", "value": "768:9Hb2w05eLP2vJOJSr7yH5cjr8qqUUUSSA:VbD0ULP2vJOJSPy+jY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627374719, "uuid": "2450181b-4aa1-44c5-9495-63469bb3a4ba", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627374719, "uuid": "c6b88487-04e3-48a7-9d77-d5c5a70e2550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374719, "uuid": "7952a862-4157-4d7f-9915-3a9d7e9aa847", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7591fc-eeb3-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1627373864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373864, "uuid": "f96384c2-3b15-4eee-9d73-fa0fefe75ab3", "comment": "Malware payload (TrickBot)", "value": "4ef09539042a80141954b7451817dec7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373864, "uuid": "c5cf287e-3c10-44af-b361-34db8c60fca0", "comment": "Malware payload (TrickBot)", "value": "ccc76001e413ebe889c2d445f817fc024b50d2bfc6676e01aaebfa3ff9a91d4e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373864, "uuid": "848530fe-ee59-4cdf-9f27-8d2562ccbfba", "comment": "Malware payload (TrickBot)", "value": "9ed146dbb7ada7ea4c38b1d34cd4fcc8c1e06564", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627373864, "uuid": "bef39fc8-37d2-47a1-af84-1b763d41ab74", "comment": "Malware payload (TrickBot)", "value": "39f4b40a6d36487e11c7e7ad2c47a9da441a4df3ad49dba4c51b3223bcc152826f9f4d132949c709393c7e8c86581714", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob112", "colour": "#09DC1B", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373864, "uuid": "1239420d-6273-4f8b-b7a1-daefb20a2f14", "value": "T1EEC4BF90EA8040176ACB2757FE0226E2E93DC0129280325BD59D775C2B975D9C3BAFFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373864, "uuid": "44e947b4-0093-4f39-8e40-f239e02ab809", "value": "12288:X2jbfhFo+ku8mcjA+zl44K6AZPYlefkhXJNer6y3vBmx5hKdYb6IpXtSPUKXAugH:mjbf/vkuCzlFP0fsp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627373864, "uuid": "c69beeca-6f7c-4d29-8a70-5127ac60ea25", "value": 576435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627373864, "uuid": "2fbc0c2d-b5b0-4eae-8943-d81d92939725", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627373864, "uuid": "e1338bb4-b02c-46a3-a232-f08af641a78b", "value": "details_5494.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5b00f5-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627375957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375957, "uuid": "3ba4f164-b245-4558-b539-3dccaa20491a", "comment": "Malware payload (Dridex)", "value": "0c0c38134875c72afde26826cd71d3c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375957, "uuid": "2a41557d-b221-435e-9443-5a5d9799603f", "comment": "Malware payload (Dridex)", "value": "ccde7438b5015713fef79809dd2fa46a1cd2ee5f81f53b322f3ec716dc6e4e38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375957, "uuid": "f4515461-b38e-4fa1-b95f-3c2abdd25dad", "comment": "Malware payload (Dridex)", "value": "f72965ef856be9cc8f3264cfd818d223f66f3f2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375957, "uuid": "47fe6931-0d4d-4356-90ff-61cbc091a399", "comment": "Malware payload (Dridex)", "value": "d142cae5c85edbf5e41a557884ee9102bb5a0696e9d5769d696be4d663c1ef0ee05f76296e1fece93e480cd2bc7e2280", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375957, "uuid": "f048d99f-2dba-4bdc-a8af-ab4311389385", "value": "T19904CF51D2DF2AD9C41E97BC11947A0976B07EC2CB28C078E266C4BCEF7BD4649E4326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375957, "uuid": "9547c81a-7df8-499f-912f-c6c99a3cfc9b", "value": "038ee71bd4ea63acaf586d3475ef17a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375957, "uuid": "ab8d75d9-f940-463b-9258-6a273b58de9b", "value": "3072:1nY5bY8XE+kkqh84cKcv4FinaLzL2rVQLOmpvNbTAvfstOr18T:lRAkkk84e4wne2nmhFAvf4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375957, "uuid": "de1bce55-35c4-4d6e-9748-86aa7fd17d1e", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375957, "uuid": "1b811ab1-bf5c-449f-b3b1-5b39c0532335", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375957, "uuid": "3e780b16-19a2-42ac-a0a4-2a78bdeae299", "value": "0c0c38134875c72afde26826cd71d3c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373850f5-eeed-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627398816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398816, "uuid": "563fe6dc-ac4d-4b12-96f9-4c0f01eaf602", "comment": "Malware payload (AgentTesla)", "value": "fa322b962d854050adb6c6546f7aaed5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398816, "uuid": "40886c74-421a-4d97-987a-508f0dfc8251", "comment": "Malware payload (AgentTesla)", "value": "cd043324499b97f0bfcd00d02c0a094aa6d8f4b33f5cd80d94ebf92445f8dc02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398816, "uuid": "7d976151-a211-47a4-b2b9-f674fad7506a", "comment": "Malware payload (AgentTesla)", "value": "b1c7f9e0cf2d4c99175bc38fb4d12d34858e5bea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398816, "uuid": "f3ad2db9-c086-4785-a0c7-077e224f4fb7", "comment": "Malware payload (AgentTesla)", "value": "9db232efe62d662895ad064ebafb7fe001037fc3590a30b95fc6364491ea64dd4ce5ae4d36129a6363591eb97952f1e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398816, "uuid": "4dceee26-0bea-49ff-a0c2-695afa1b4b50", "value": "T1B2E4BEF83639375FF48384BE64B45CA6695010EAC92EC792F33341ABEF0D49B9600697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398816, "uuid": "ea19a3e0-4c7e-4fe3-977a-a9839a25e8ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398816, "uuid": "930055f0-5e63-4dda-8343-9af2a6605ce4", "value": "12288:HroIuDxrIbMkbWcBjVbN638Mme9MDqJaxOv71evZ2B7mo5oFCEkv:EBKMkawzMme90g7mo5oFCEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627398816, "uuid": "4516430c-3a3a-4527-a314-3e86381b739b", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627398816, "uuid": "fcb11108-b68d-46dc-b7eb-673352de5928", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398816, "uuid": "3283bbc1-976a-423b-b894-3123f711b672", "value": "fa322b962d854050adb6c6546f7aaed5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae744bf5-eeda-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627390856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627390856, "uuid": "d2472211-0b8b-4404-a3b1-7039353c22e3", "comment": "Malware payload (Mirai)", "value": "bccb14d92fcc98d3ecfade6a5e56d321", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627390856, "uuid": "0e2a2995-344a-423b-9bff-6b409c804d68", "comment": "Malware payload (Mirai)", "value": "cd1df46923524de02c032a64afbbe7316c4c40f1a4242fc8b7227cb19b9a9337", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627390856, "uuid": "86adc538-81fd-4489-b23a-c82a6124adec", "comment": "Malware payload (Mirai)", "value": "dfdde835ea17797d5f4643ae24dbad73f029fcac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627390856, "uuid": "182140fa-0fe7-4b92-80d4-ee666f627505", "comment": "Malware payload (Mirai)", "value": "13d2fd93c9f2a280c42b7b6f140feb94a6cf2f96c1102dc80f0700520422d212bc60e35c69fcdd8a51785061a21d9205", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627390856, "uuid": "64cedbbc-dae2-4970-883f-3c1f24dfc724", "value": "T185640287FB217C1FCE020FB121DB078E66BCA65B82CB9091B2D4C95F35B6185B7A11C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627390856, "uuid": "86241a1c-3d4d-4d1f-b835-62eddd9c8ea8", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioK:p3lOYoaja8xzx/0wsxzSi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627390856, "uuid": "4e3e0aba-4e38-41bf-8cbb-cd5892e66518", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627390856, "uuid": "c23bfb58-c3d3-4b24-b15e-295b06bc63b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627390856, "uuid": "5b7a45b5-15e0-42e1-b99c-fdd8191724a9", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016561c7-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1627400444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400444, "uuid": "013408e4-8411-4e2c-8bac-e0a876b0e72c", "comment": "Malware payload (ArkeiStealer)", "value": "1d6b63ce5bee7ec6455dd282acb1b5f0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400444, "uuid": "f4783e19-11d7-4fac-8b91-d8714b9aa4b3", "comment": "Malware payload (ArkeiStealer)", "value": "cd6e802e4d9d8fc24642cb0c5e441fbc2025215c0d99252ff01c40350642937b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400444, "uuid": "68ee4684-94b5-41aa-ba83-3eb5c02838a9", "comment": "Malware payload (ArkeiStealer)", "value": "d47332f568b6f56d189671aaf00cbb9a52411d49", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400444, "uuid": "20400e04-149a-49e0-8786-08e6542f3dae", "comment": "Malware payload (ArkeiStealer)", "value": "66cc13070fbd1617c8af961e6af46066b11e4e36e8f83eed35dc91cfdb9839c0f13aa4b941f70b6c5f6968b98ee52996", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400444, "uuid": "ff9db29f-0d99-41f1-aad7-9381439406e7", "value": "T17ED522836084DE29CDB80B3E390554FBD3521C7ED6AC1419EECBB23D14BA681876DBD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400444, "uuid": "2391d404-c19e-4912-a6fb-88836d45c0f2", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400444, "uuid": "c67c395a-0e18-4cb9-95f0-05bf63869424", "value": "49152:HULHppppppppppike+zIfx1K4yw+N00O+devml/DkgaHfBO+q58OuwAr:HAHppppppppppE+Kxw4a00O/ml/og1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400444, "uuid": "34ebe86e-c943-4615-9c61-1ea6d4947128", "value": 2803896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400444, "uuid": "3e1a4657-3e9c-4798-8f94-6c11128b8f75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400444, "uuid": "0fcc6f36-34e6-47e8-80ea-a53c58ec4a1a", "value": "1d6b63ce5bee7ec6455dd282acb1b5f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1aaebf-ef09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627410934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410934, "uuid": "a80054d2-807b-46c2-b6b3-b0af24d4ad0b", "comment": "Malware payload", "value": "96c9ee0c1bfc81f5f7a2cd37a29a209a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410934, "uuid": "957e7ca2-da63-4aab-987d-d517a51119b2", "comment": "Malware payload", "value": "cdaabb25c23c32c410321b5e4f3cdcc72c0b5c9364a41b5107a3268908f38da9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410934, "uuid": "22c706fd-8c7f-488d-9e13-e6cd640ebe7e", "comment": "Malware payload", "value": "b79dc8253709f3bb9b14b0203d102ff4b1f9499f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627410934, "uuid": "60794875-a98d-459a-8adb-2a706e5b48ca", "comment": "Malware payload", "value": "ebc63862197513aff7586ad822027326509d70464a7f47488509105efb80e6a4667831b76866f1f835015690aa18883b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410934, "uuid": "3877e1b5-d922-4bc6-9ef4-6439b371fd63", "value": "T1775301D1CCA3C4B6CE9351AE4F16007AB01BFDF5B2AB2331342A45DC6DE14C899DE999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410934, "uuid": "84885331-3b9a-438f-a4ff-c3302792d295", "value": "1536:9urKmQErOoLx4aBbfRi1OEGW0u556tq/WAkRnNX:08ErOoLx4sfRiGWx6tqEJNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627410934, "uuid": "3cdc04e3-adef-4fb3-955f-292665249008", "value": 62552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627410934, "uuid": "aedc7bc1-0a3a-4a80-8d14-6e0dd59f12ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627410934, "uuid": "09066969-3755-4781-8da1-febd96d025b9", "value": "96c9ee0c1bfc81f5f7a2cd37a29a209a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2611e514-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627375595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375595, "uuid": "6089f7ee-3768-43b7-b9a7-08b60de7bbdf", "comment": "Malware payload (Dridex)", "value": "4dfc77e45068635df70a32fd5bcdeb01", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375595, "uuid": "931cdeb5-f71d-41d2-b575-3f67aa002acd", "comment": "Malware payload (Dridex)", "value": "cdc866753e7d7865e67e31047a60468f6c7eb80290df4c4e16d3697eb8db12b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375595, "uuid": "b945ddc5-ee3b-4a31-aa12-c4087a4a93dc", "comment": "Malware payload (Dridex)", "value": "01e6f96db1fc9adfb6ef49beed0abaf6a12eab3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375595, "uuid": "eb4e864c-0fb6-47a8-8a8a-de48b751a738", "comment": "Malware payload (Dridex)", "value": "00cfdac15c7979de950784294fe523609e9ae06d8a6a85f3377ec3e11ece8393988c9b48d8ed712311a442dfda3da7e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375595, "uuid": "55985266-3abc-4e45-9b03-372cf2cc6b53", "value": "T19D64128AD077C1CAFD97423A29C50FC35A473C1685EA98B1F37192BDC025EEE7A41197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375595, "uuid": "b155b16d-48c9-4082-9e78-a5d8d1c3aaf2", "value": "6144:2LRj+sWRo6tcJhv7Bzg+8h6F493OzNStilCZ4gNTj2GJInBf:2LJ+Zenzdl8OLzNSt3Zt2Gan9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375595, "uuid": "c6259eaf-04cb-4891-abc4-535fb4cee4df", "value": 336262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375595, "uuid": "a6946b16-ded2-46ac-aa2e-f6b1ea05f8ca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375595, "uuid": "6b423dbf-ca49-4210-b858-b18d39d70e75", "value": "Invoice_115952(1).xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c5bceb-eef9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627403964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627403964, "uuid": "57079be2-a5e7-4373-b824-633602165090", "comment": "Malware payload", "value": "ce92634fff801af8ce0a1263ce436fc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627403964, "uuid": "46f48c57-3571-4103-a484-defdb187fa85", "comment": "Malware payload", "value": "ce9fb89fadc9b872b78b1eb08bf0e160f08c00acf7de61a490de8d62a5d770de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627403964, "uuid": "e0e7c5db-4aa6-42f3-b63c-9c1f83ef5f41", "comment": "Malware payload", "value": "28c4d7ca4f3f3680b2d23a109c2b8934c625c219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627403964, "uuid": "c31dfcac-fb18-4348-a9f1-1c018e0eb9ee", "comment": "Malware payload", "value": "cee529211fe45f1fb27691fe9442449cf849585c41d53ea5181a73db7ad55a23cb4e733cff240725909d5af131c3a08e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627403964, "uuid": "70e09be5-4477-417e-9a8e-1792abbe477d", "value": "T15535CF2363177B58ED7D837B9C9891809BFAEC07D316D97D3CE470E86871FA86660602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627403964, "uuid": "73e8bfed-213f-40ab-9f49-777409a8a3ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627403964, "uuid": "81c01a27-7c6e-4151-a8fe-e0e56746234d", "value": "24576:4FEKJvDBgNBMPLdViVosIrQYUIb0ti8fMBfYa:MMMPLziuzZwt5fMBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627403964, "uuid": "f2fafdb8-9bad-45d4-be49-95199fb533be", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627403964, "uuid": "d890dd1e-d721-4d72-af09-d2fe1113d00f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627403964, "uuid": "c72401e8-999e-4a03-8729-2c8ca5e2391a", "value": "Payment_Advice000987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f4ceab-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627372076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372076, "uuid": "61111026-710a-4973-810e-093ab8a41d45", "comment": "Malware payload (Dridex)", "value": "7042ee1bdb66342f4f19304fff77d08b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372076, "uuid": "27d8b69d-c946-4b18-a43e-3cd1a93a07ed", "comment": "Malware payload (Dridex)", "value": "cf56df192c905336714c2295fd771cb2ed6ade7167705b0442bbc8dde72072e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372076, "uuid": "fc99b96d-b0fd-4374-8c9b-277805a59aa0", "comment": "Malware payload (Dridex)", "value": "63caafaae69081882da379556b17a2b21dd96963", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372076, "uuid": "27bedd8f-5290-4ee5-b484-ff2ef519a8d5", "comment": "Malware payload (Dridex)", "value": "15f84f10098474f2e6c119326ba06e513fcb1423eeb585bfe7b32aca38e7253a733e987023e51d85349b9da3f159cc61", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372076, "uuid": "3df28383-0192-45d0-bc3e-e3928a9ef5f3", "value": "T10804D161DBE759C5D7A3C57ACC8CA17BD1293C0B8A6CD2BC6208D2CC897AF0CC5A4D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372076, "uuid": "998691fb-978c-499e-86ed-13f884de4932", "value": "89aebe8644a760ddbd7c2e801228e7e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372076, "uuid": "6ffcfc88-2b71-4974-97ac-180f7f083acd", "value": "3072:CDNLuxQI4JTJlYDFS6t2NAgEaakq7MCi6TM7EANfFln:CD5PB3ot2ygEasni6TM7EAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372076, "uuid": "f20cd84d-1e6c-4fe4-a9ed-33bb93ec48f8", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372076, "uuid": "c0ef80b2-d6a1-456f-a06c-2348793201a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372076, "uuid": "3d91560a-e3ec-418c-8f0d-cc7d0fb0afbf", "value": "hsy_utu8_12u_v4.4.7.0 (4).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf152b1-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627375552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375552, "uuid": "f56102d0-dd92-443d-ad17-dc35fa4ebb88", "comment": "Malware payload (AgentTesla)", "value": "8bf9536b65dec39bbf0b8733e4ad2ac4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375552, "uuid": "fb20dc1c-b61f-4ac1-8ae3-9255863e813e", "comment": "Malware payload (AgentTesla)", "value": "d022b7b48419dbef83e9d084602cbb5b10566d193db01248a72be46251669a97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375552, "uuid": "d0070a51-972c-4784-8d3c-bcee7c4e9c6a", "comment": "Malware payload (AgentTesla)", "value": "d7a8458e48bc1abddddaabf8e3ac6d35ef4e2c7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375552, "uuid": "6f677308-25cf-4279-a5aa-178f35bb5737", "comment": "Malware payload (AgentTesla)", "value": "4bfd5903dff101a2440920ec1a05408796ed381ad6c57eccccbd3fd970a1455b8f2bceeea1ad2a0b309c2d5b7fd6560b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375552, "uuid": "62eed018-610a-4c2f-944f-622968174017", "value": "T1ABF4CFE41528BF2BF06F0B7D907140625BF058DBC969DBF5FF3224EBAF252962051286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375552, "uuid": "8a501fac-5bb4-4a56-963a-466cf950e79b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375552, "uuid": "bd2cea0b-2cc0-498a-8028-5304b7e7daa9", "value": "12288:XqaPU9aPU91wvBE5/V62OsBgo0q4wMcFRiNSNvR3bfyo7BYNtMj9seqQRoLJaDCf:Xqf62OsBgo0q4wMcDp32kmvMGQRoLJWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375552, "uuid": "cfc136df-dd79-478b-a8d6-7e9091767c2c", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375552, "uuid": "bb6d4805-eaf4-49ee-98cd-757cee2c3176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375552, "uuid": "9677c90d-0429-4ab5-98ca-a31191de1baa", "value": "AWD SHANGHAI SHIPMENT SCHEDULE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ee9625-ef34-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627429412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429412, "uuid": "f46c8ef0-5add-478e-80d7-5bf825b16047", "comment": "Malware payload (Formbook)", "value": "1dc4a1aa19afef7c048a09bd00153ae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429412, "uuid": "268a020c-16a9-424a-a63d-291855d2cb99", "comment": "Malware payload (Formbook)", "value": "d064e13de302104e85c1fbc8b177bc3b17ecf1dc0063ff1865d825b219d9f11d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429412, "uuid": "874c97d6-8627-4555-8746-928ba9ce8ddd", "comment": "Malware payload (Formbook)", "value": "cfeac51f7427a964ece4c8faac0e028d31e4b7ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429412, "uuid": "217d89fe-5092-4b6c-8b59-ad6954454904", "comment": "Malware payload (Formbook)", "value": "8a3adb542c46e5a8fd9b3758605638e3ad99caab1a64cd5c66c2b5407ef892c161fb1108aa7d04c2ff85746e58b671f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429412, "uuid": "3933aabe-1c49-4b55-8490-8e25a7e38289", "value": "T152158D125DCF865EC2694DBA9731AC5682314DAA2948F3123EC174EDD93F3EDC89F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429412, "uuid": "24af8711-5c09-48cc-9340-cdf37c5a6bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429412, "uuid": "747a3a6a-7ff2-4b81-ba57-e3f1ebd6e140", "value": "12288:e47FNR1Xoo8tjhBs3Lh8LdFiNBojT41P54HTY3agnORASMPQipP5q:e4hNso85hBS8L4B0T41PaTxipQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627429412, "uuid": "72b395e3-ca42-49d5-84fa-c3e10ef60b23", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627429412, "uuid": "33f2893f-1d42-4ed6-97be-b3eb68f557c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429412, "uuid": "79d9f325-c69f-47d6-8556-1f6e7c49fa14", "value": "TT Transmitted Copy ETT1037468..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a01f47-eee6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627395773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395773, "uuid": "92d43e78-5311-48a2-a2d9-94e19001c864", "comment": "Malware payload (AgentTesla)", "value": "8222e7bd5783b30d0a64b6f9e1aec2ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395773, "uuid": "b85883f0-72d7-45a8-b7fc-5e66a6979111", "comment": "Malware payload (AgentTesla)", "value": "d19edc2ae1e9d8c99b477c45960499e400afaad377a85475af9eebfc752cecd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395773, "uuid": "c7ed0d3d-ff98-4946-8edf-64571e617045", "comment": "Malware payload (AgentTesla)", "value": "f8a8ba5d2dcffffe488c345134e324c97652d000", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395773, "uuid": "2b610697-625f-47c8-a196-d0ac524c3a82", "comment": "Malware payload (AgentTesla)", "value": "72c300f5ac9e24c159709bb2535abc916a9e9c6a6a6f58e5e53e4b19fa3048a30cd589eca6f627b1675d963a1b3553d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395773, "uuid": "a3f3f670-522a-4715-88cf-9aa043fd7de5", "value": "T1D9056DA9B34429AFC7ED8131B594AC14F5811EB23A33AD0FA187308D877E9C65951CEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395773, "uuid": "2e774704-c85a-4a52-a47f-ffba4b6ae3f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395773, "uuid": "3d273204-55e4-46e0-9438-4dbea3c7c8eb", "value": "12288:khmIxM85w1kJjNgp0ZQACQaKlnFSM/NjpM19tDkq56pJEqV97qVB0x10wzAOhuJR:tl83jW6QACQv/Ri19tYkIJoJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627395773, "uuid": "16570f48-2ce9-4dd0-b593-f919173f8f9d", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627395773, "uuid": "f597157f-48b9-46b5-9412-0da9e8a89854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395773, "uuid": "7469b28c-a7d5-44ba-b214-2a5d3abf13f0", "value": "fda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22467798-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627413813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413813, "uuid": "c594dbe4-d557-41fa-a438-4703eee9a80a", "comment": "Malware payload", "value": "a332a792d744ad382efeea6c46357404", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413813, "uuid": "e59c1673-d244-42e3-a965-53f35b018f75", "comment": "Malware payload", "value": "d1e21054e120d9a1d580119c396b21ccf2adf680a8568861b8d27e5d3c71df05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413813, "uuid": "6263fc5a-643d-44e5-9e1e-57ddf50fbfc9", "comment": "Malware payload", "value": "c6a7e11bcec319fd521da84c8004612b7d875962", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627413813, "uuid": "a4b116eb-7cb0-452c-8ba1-c2e6bec2302d", "comment": "Malware payload", "value": "09f24de622383e02ca246f5a8a9feef0b931145ddb978813339bab2fcaf611bd95b3ee981978c20fee30c8f65a8a70df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413813, "uuid": "92ac91e5-52f7-417d-8705-9e1d8afe13ed", "value": "T1B66318817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413813, "uuid": "33b50067-e2ef-49b6-a1e6-6b147a883fe1", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8QM:GbtexU0r8QCKw2FbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627413813, "uuid": "f65f6100-c9c0-469f-a082-2c487b3f1063", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627413813, "uuid": "5573a1a9-5969-4a69-bc53-e630d2d2c218", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627413813, "uuid": "3678e211-8451-4cfa-af7a-573ade4b803e", "value": "a332a792d744ad382efeea6c46357404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9c5bcb-eea0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627365866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365866, "uuid": "93a414c5-f83a-4403-b6cd-d6f52137afd9", "comment": "Malware payload (AgentTesla)", "value": "ef2cd714ea2dcba7814ca37c5fb583f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365866, "uuid": "4cc10022-a282-4675-892e-79a640e2edec", "comment": "Malware payload (AgentTesla)", "value": "d2a9e5fd925d49872bb2412d446d162dd47673f1f94998589d1a663d28419e67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365866, "uuid": "b83d1f37-9e87-4d8e-beb5-ab3eeff2410c", "comment": "Malware payload (AgentTesla)", "value": "303b055e7d7fd4548cd69af352e56ebbfb6f0893", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365866, "uuid": "b1ffecb5-0b26-4077-8374-58ef6ea6fe21", "comment": "Malware payload (AgentTesla)", "value": "98a45709a0b072e0b94a9232dd57d2e6a9061f0374f984cc269919929f1af9a67aebcaf01fb68c22b2d43401cff7ec17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365866, "uuid": "c97bb968-8a91-4b41-9754-9db0f12537f4", "value": "T10DB4233844E1AF44796F9E6E413BF5A6D7D8501728BEDA438FC20F8C9E67C258950DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365866, "uuid": "af6dbbdf-7c5e-47c6-9337-ee653a0f4f35", "value": "12288:vXgene0jEw6lJhPEY3OkqplPI5w7x+DA/ZjK18Fw9:vlbjbehPEY6pxI5mxwAhjzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365866, "uuid": "01159141-34f7-4a67-93ab-a9be526b894c", "value": 542891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365866, "uuid": "e405bb51-75cf-4e85-8922-15561187cad6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365866, "uuid": "3ab0008c-914b-46d0-a21e-09b51314dd4c", "value": "Payment Slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9db080-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1627399734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399734, "uuid": "36708d8b-b130-407a-9815-59de8de71f7e", "comment": "Malware payload (Smoke Loader)", "value": "cdcaae5709190ead7b126d3f06456d9f", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399734, "uuid": "8df2638f-4b76-4e30-aa71-b75b9e0bfc7e", "comment": "Malware payload (Smoke Loader)", "value": "d3849946eb2dd2aa6bebcddb30751a4a99bc05ee5011db3f5081df2f970a1854", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399734, "uuid": "bb70f6a4-ab35-4200-88e9-19e3f5cf92c9", "comment": "Malware payload (Smoke Loader)", "value": "3548a576e212c7924413e58157b697a66a2d0077", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399734, "uuid": "dd380149-be1d-465d-8398-295d716c96b5", "comment": "Malware payload (Smoke Loader)", "value": "cbb4cbbb34fd5c583f980ef80b831209377f8b0c191e6ffebac13ed4067597282583d86061a7da38b7327489d816da8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399734, "uuid": "e1236422-2454-4011-8281-fce61a90f04d", "value": "T154649C20BAA0C435F6B212F84579937DA5397EB0A73451CF62E03EEE46346E5AC31B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399734, "uuid": "064d32e4-1dba-4c95-915e-190db5273069", "value": "cd8b6907b5cf87baf066346ab3baafdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399734, "uuid": "fada2620-e1d0-439f-ae51-533a4d0ca8cd", "value": "6144:oVFzlJyKsUnXQx5E8bBDDs9OwwI04c3Jr0MEfVc8NmivV7HKU:2/9sUnXqi8bBDIO1IpwNXqJtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399734, "uuid": "01235af8-17e8-4e43-9b4d-1e7d16f85a89", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399734, "uuid": "60034948-f4a8-47f6-aeb0-16aa48ae21e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399734, "uuid": "6d914d6c-c37c-4d68-bcca-54108542a9e1", "value": "cdcaae5709190ead7b126d3f06456d9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c0028a-ef20-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1627420820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420820, "uuid": "16fffce2-b9cb-4d48-a1eb-9c934156d000", "comment": "Malware payload (AZORult)", "value": "07bbcef0e5853c96d1fc0f0beab5f42c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420820, "uuid": "0a0ae7f2-281b-40b1-b15c-a4db46253615", "comment": "Malware payload (AZORult)", "value": "d3ba82618b3527724f29e835c333807e9d72e51839990c6e95e072825cf99150", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420820, "uuid": "71c63570-807c-4892-ac2d-181d62b00c32", "comment": "Malware payload (AZORult)", "value": "547bfe889f5e3b96aba97b79f0b0780407b83a32", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627420820, "uuid": "c3f7432d-d0a6-464e-aba6-cce4b3743c63", "comment": "Malware payload (AZORult)", "value": "a0a5fa113e008f835a5c251d1f5c51006470d171ab7cd77645bfa4856dc3a0a295d517fd2091785a6ba23e2b9a60fb9f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420820, "uuid": "c3c5dac1-911b-442d-a6b5-d15062e92222", "value": "T1EDC3F046C33E9B92D0D4E8B0459E757B9E6ECAF6E11FA6335BC6CA000913DE11944F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420820, "uuid": "013961f0-fcfa-43b3-b274-30268c637fba", "value": "9950763f1f076fc4932f4546c63f9137", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420820, "uuid": "adf0b0b0-0c5e-4694-933c-c9881742f043", "value": "3072:9SxUJuKvONa6LcD/kN6zO9TYVbfMfvw5UaC2P:8CJWHi/vzOBEbUf4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627420820, "uuid": "d99eb0ce-9a4c-4629-9812-fcb6216a52c4", "value": 127090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627420820, "uuid": "73453e82-c9ec-40e7-92e4-d3762b4af021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627420820, "uuid": "15c3a5a2-865e-4d91-9426-9dab8b87fb86", "value": "RFQ Quatar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288914c1-eee9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627397073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397073, "uuid": "8c131f82-c262-4f41-a6b5-0dc8235f59d1", "comment": "Malware payload (AgentTesla)", "value": "193cd9e42d452e3523d04654c0ca883f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397073, "uuid": "646309e1-cc69-41f7-a030-a2ed20a93e6b", "comment": "Malware payload (AgentTesla)", "value": "d3eb7e966bf389f4139c625dea6d218f0969440101629a0e11302d0e547dee85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397073, "uuid": "0f6ffd45-df84-46ed-a42b-daa2072bb5e3", "comment": "Malware payload (AgentTesla)", "value": "e13557a7ea1c29e4376187eccc9d000290cfb32c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397073, "uuid": "a5e5c68b-3558-4b6a-a4ef-98f084c28807", "comment": "Malware payload (AgentTesla)", "value": "e9c1143ffb7803dd1911b1ccac7ce3ca499fb1df60fcbc5010ff8d629f7d545daa15b9c235e43793658c7f5ca3e5e82d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397073, "uuid": "22dd473c-8fc7-4817-b4f7-e8cddb85f9ce", "value": "T1FC15F1663227A208DC3983F55C64D1B07BFE6C2A626CC27829C8BDBF7D7267C5AD0541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397073, "uuid": "cd8d7f10-f496-49f7-b0ed-45f7fc1cb176", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397073, "uuid": "1907b882-81d0-40c7-969a-140242b65c23", "value": "24576:5vDBlBPIOBPAT3b9iaGiAuFMIWJLJQLyOLW4:9pPDPm3b9iaGiSIWpJ69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627397073, "uuid": "09dfa889-38c2-48be-9119-77919f3117a6", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627397073, "uuid": "317a31d6-ac41-4eeb-ac52-d5fa794a95a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397073, "uuid": "ab041376-be82-4dde-bec4-f102933bbd6b", "value": "Order#732B9_130321 Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fe2f06-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627396915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396915, "uuid": "9c8377c5-ff52-4aa9-a65c-f40c27403e1a", "comment": "Malware payload (Loki)", "value": "89815ce5c4fb75d69867f360f0d41de1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396915, "uuid": "edacccb0-3272-42e5-a165-fdba26af3385", "comment": "Malware payload (Loki)", "value": "d426f1fae508a5168dbb51ea63c1159af102de6bdbd49b9cecde6d7b049d1b20", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396915, "uuid": "fba2815c-4c99-4537-bad1-78bbbd2f6747", "comment": "Malware payload (Loki)", "value": "b5905136d4ea1b3ed313cbf8b381abd0dc7dcdab", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396915, "uuid": "fb724f1b-2b22-4f44-a21e-0480a4948df3", "comment": "Malware payload (Loki)", "value": "141da3637181f6bc6ddeb717a9ee684c01941ba35ff4aea9d853dc7a259f7e412178ba0ecd40b6d1d93567414fe37ac9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396915, "uuid": "8c04a0e5-f71a-4b0f-be32-ef345474929e", "value": "T19E4513397B6E1D22DD92417486AA0B476388DCE76313E0D77DE4750A2CB36BC47C249E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396915, "uuid": "b5d88208-2344-4e2c-bec1-424f421445f9", "value": "24576:TaqxM3I5xpU4g4ATF4c4LOVZFISUIV9x1R+nsvLmrg1x8KXJ:5zw48FZ4LOVKIXx1Mc11DJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396915, "uuid": "bc3dde01-d2cb-4d49-af0f-f003548e0c07", "value": 1183232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396915, "uuid": "c5090739-79a1-4218-ac89-888016b8ea8a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396915, "uuid": "edfa0cfd-034e-4574-8d62-6acae7e638b3", "value": "P_Ord_Doc_CRG902G ZE3329.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a5f43d-eeec-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627398575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398575, "uuid": "0bf2d201-38ef-46ff-bae0-faf99b65a682", "comment": "Malware payload (AgentTesla)", "value": "a0cab74c67a1fe34a45d34999dbf7b98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398575, "uuid": "f9c49dea-8827-40c9-9c69-299260c76046", "comment": "Malware payload (AgentTesla)", "value": "d583118d0d3892d229f1380727540b51a8ad7ff5ecee7a7296ebe29ae4b31480", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398575, "uuid": "1c97679c-7d41-4f95-9419-888c2491d64c", "comment": "Malware payload (AgentTesla)", "value": "6e01bdbd54dca8fe7ba3468c4d0b16a06c6e7fb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627398575, "uuid": "3ce6a7c0-5dea-4ec0-8da4-515ad8fd6092", "comment": "Malware payload (AgentTesla)", "value": "91ecbabb06ccd56102e3da753bb102ad956a61e01ea5df890e3d54a2b1ed833ec1a3428cbc40b415856d1239aa73fa46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398575, "uuid": "57a12411-4179-4a0c-92cd-042b76f65c7d", "value": "T132E27D013384B663D3695B3382E361155BF0A3D36232C55FAB8A638C4E82B419E75BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398575, "uuid": "2f0ad0b7-a38e-4df9-b0ff-76e94653869f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398575, "uuid": "40b16351-1763-4124-9eb9-a60a58742e6e", "value": "384:P/PyPWtFfAZC8iZMxXoG3XCZXmH4Ipa1DEzbUZ2ItgHr1h1qhbXyoSgKcibhO:Q3XoPuzUatBqhbCZHcqhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627398575, "uuid": "f9afb2ef-218b-4ac7-aa6c-6c08f853a8f8", "value": 31640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627398575, "uuid": "ae06a60a-8757-4056-9247-28bb059ae5eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627398575, "uuid": "e6346823-c65b-46a5-96f3-cc89516e24c5", "value": "Kelvin@file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc21f95-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627366318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366318, "uuid": "1dcb5fe3-810c-486b-a34c-f757b636452c", "comment": "Malware payload", "value": "2a48d711028fbd0eb21ce85e725752af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366318, "uuid": "b7424890-4138-48aa-b075-8378f9f58589", "comment": "Malware payload", "value": "d5e88edd7513f73190c297406857eaffe88644b5d79bf0dd6c343da097bb2cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366318, "uuid": "b952ca3a-6fbf-429c-af8b-87179168cd7f", "comment": "Malware payload", "value": "effa85fee1e1940417c88227050e36fa42fc4f2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366318, "uuid": "de8cd2ee-deba-43a6-8155-5739fb5b1e87", "comment": "Malware payload", "value": "2553533ed9b3255e7584c8352c2b809370d938d644df8b26a0d5ad91e9f73107d8bb46bb58c8e029a53f06e420682b23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366318, "uuid": "42deacdb-572c-4668-83cc-a91aaf033462", "value": "T144A4E121D209D3C6D1A209338172482215D76C7BA26E82DFF3E8F9BDA4B5541FC6E71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366318, "uuid": "26ca757c-199a-4315-b53d-69b491e3bc8f", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366318, "uuid": "ccb55ecd-2279-45dc-ab5b-d6e6f604b1b0", "value": "12288:2d53TvpHeIl0Yofyf9TMN4Kx8QoxQIupDfghiiNUoJHdM:2d53TvpHeIl06K4KxkxKprghaod+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366318, "uuid": "80b077c3-38d2-4852-9cd2-5a869816f402", "value": 472350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366318, "uuid": "677539ca-2158-4879-b0bb-a01ae905086d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366318, "uuid": "aa7cdc83-bfbc-4f59-b25d-902a4a94fc69", "value": "000900049000TTK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f977377-ef03-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627408225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408225, "uuid": "322349a8-1ed8-4d06-8aaa-166dd5872331", "comment": "Malware payload", "value": "825cbb275c093bf072f2aad913868ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408225, "uuid": "2c98413d-e142-4723-a7bb-d4a8957dd8bb", "comment": "Malware payload", "value": "d67d60c7f4d8fb4d67571d372fc1e6ebd9cf1a12e7c4223b8bb4eb16d4c96e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408225, "uuid": "99a4e524-4b95-47a6-b9af-7851090a5192", "comment": "Malware payload", "value": "4b2416183753e26090d043620894264fdf26f95d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408225, "uuid": "abab2d87-932e-42d4-931e-9b99a256deb2", "comment": "Malware payload", "value": "fc092ae4be38a76493d51aeaf96ca4d087d29940421e4eb0a7fcc5972087df6954f7291cc956b3db18da0271ad9ca9c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408225, "uuid": "aa1933f6-af6c-4f3d-a4a4-80ebd283cc09", "value": "T163159D525ECF865FC2694DB65731AC5682314CBA2A48F3122EC134EDD93F2EDC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408225, "uuid": "077083e6-4d1a-49db-bc60-9419ba2291c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408225, "uuid": "5630a559-b1bb-416f-bfc6-7cf98d6c8d25", "value": "12288:2lHz8zH9WjhiNKH9DqWftROuUatACuc2KUVOpH4hH8RUsejSMPQipP5K:2VKYhiGftYhQwibipw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627408225, "uuid": "21bc767f-d4a5-4ae0-9af6-58f4a9bff91c", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627408225, "uuid": "d74e12ae-42e6-4091-8cf4-9fd229143543", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408225, "uuid": "33e36372-4a88-4976-a323-828830233476", "value": "Order 4110043899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19657b89-eebf-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627379009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379009, "uuid": "e4401ed8-4768-4f9c-aaa1-1a655ee5e235", "comment": "Malware payload (Mirai)", "value": "10e1bc7cca27d3f8f4ae427bc95dabff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379009, "uuid": "741a5259-8a41-4650-930e-8d702ee9c9d6", "comment": "Malware payload (Mirai)", "value": "d6d119158aef48b2b481c8071bc5d2fb146d385063093c4d871b9a3aa01d8afe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379009, "uuid": "bcde0254-f701-4538-b413-51edc66ae682", "comment": "Malware payload (Mirai)", "value": "d83ce4cf841ca843f29b77113cb13b26bb1c23f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379009, "uuid": "8ebf682e-ac16-4ae2-bbe7-55324b5284ba", "comment": "Malware payload (Mirai)", "value": "30a675f946e2018637b9f74cefdb80c7325ccc5a123cddf60b4d97d720579bcd766eec0bd8f306b3ca18a30a52cc3597", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379009, "uuid": "3530efdd-7636-4773-9d3e-32812eeb2cf7", "value": "T1C2135B66C8796DE8D2094374A5394A742B23F408D2A7AEF44A56CB659043FECFF093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379009, "uuid": "6e491097-93ed-446c-b7fb-be511180dda1", "value": "768:EjvOH47wtse/lB3RzhBq8HTqXJDCcroi1ACH:Ej2HGwtsKHBqY4DAKACH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379009, "uuid": "0580462e-a1cf-4110-ac98-ff8460d9e5fb", "value": 41856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379009, "uuid": "eebf1a96-5d7f-4af6-a7bd-11e9a56bbb99", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379009, "uuid": "7714ae73-6458-4648-a853-97c68d2bb3c7", "value": "10e1bc7cca27d3f8f4ae427bc95dabff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf243bd-eeb8-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1627376062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627376062, "uuid": "dc7fd636-78a4-416f-a9ec-9624dda308a9", "comment": "Malware payload (Gozi)", "value": "499200f6a8e223c057c6e16701740721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627376062, "uuid": "7286692b-dded-4bec-b052-c2e44f725863", "comment": "Malware payload (Gozi)", "value": "d7e64f8e65ce586ce2f0a857810b2a23f85140bf5e52e5a824f09787fb2bf45e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627376062, "uuid": "1483b60b-49d2-4fed-94ee-6c781c767c2f", "comment": "Malware payload (Gozi)", "value": "ef46f9c62b94715b750173074c51100285ff6fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627376062, "uuid": "16de4af4-a1d6-4f15-972e-9aa1c0010221", "comment": "Malware payload (Gozi)", "value": "8eada6b8d13a9db276541b7704682707600761c1b727372f675b58742bb0a75dfb78e4628c34f182b3e4906ad223b483", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627376062, "uuid": "806879ba-e168-41e3-a41a-bf4eaaeab027", "value": "T153448EA5ADD489F6E85D0035C8D58BF16FED9E30E7E6604743A73B50A8B32D2223D50A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627376062, "uuid": "7f2359e0-b7ee-4555-b4c2-436d64e54529", "value": "d34313ce3555dec95480bcae2d5dea6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627376062, "uuid": "cf6bbcbe-7d16-4e02-874b-a03ab43feb2d", "value": "3072:SEF7LCAtgVteclWZuw72sQI6ja4IyXBiGqfWOSi7NTk+0UylJm2os4nd41RgVTo6:SEFXKVteapw7SIJ4G9dpNyjmJLsRGPhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627376062, "uuid": "ae4b71b7-0fe1-48b2-b6de-7d553c679ced", "value": 258504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627376062, "uuid": "4faf2881-00e3-4c45-a7a1-628c7c3fa084", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627376062, "uuid": "098cc1c6-9414-42aa-b3ed-7e83210c341a", "value": "direction.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9180caf-eeba-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1627377237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377237, "uuid": "4254b544-d61a-4351-aa1d-d887bd8b03a8", "comment": "Malware payload (ParallaxRAT)", "value": "c8808d17e4ce35534a702f4b318684ef", "object_relation": "md5", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Key 4 Solutions s. r. o.", "colour": "#DE56CB", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377237, "uuid": "2b156d6e-e14c-4178-95c0-a1ff052015a1", "comment": "Malware payload (ParallaxRAT)", "value": "d8eb5792d969c21c364da69eca1322ab5f63e0a39b0e542bad4ee95be873c296", "object_relation": "sha256", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Key 4 Solutions s. r. o.", "colour": "#DE56CB", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377237, "uuid": "99a9c6f3-fe3b-4770-b1d3-ba03a6444a1e", "comment": "Malware payload (ParallaxRAT)", "value": "3739e8d38d5598a0ac67bc06cbef408ba6e3aa8f", "object_relation": "sha1", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Key 4 Solutions s. r. o.", "colour": "#DE56CB", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377237, "uuid": "70fccec6-7a65-41e3-be97-8c92e8689dbc", "comment": "Malware payload (ParallaxRAT)", "value": "338dc671023ec1d1d3121e757cf4ee209afbe5e51fa8a3317508722d5825201facda7f97ab30e1e98b1eedaf04838d16", "object_relation": "sha3-384", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Key 4 Solutions s. r. o.", "colour": "#DE56CB", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377237, "uuid": "2ee36170-c024-4621-8e3a-7dd5a334a983", "value": "T13D667C22F244963ED49F0A39442BA664993F7B313923CD5B97F4588C8F365817E3A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377237, "uuid": "1278fd4f-1b4d-4080-8082-8728333dca62", "value": "ef55257d8e5414c1ada866422d7543c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377237, "uuid": "521def7b-1ae4-4526-8e70-d266470b75b6", "value": "98304:OO5VI/yA/FFrWw//NtM/SmfGnp3b0o5O:/I/D/M/SmenP5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627377237, "uuid": "2efe76e3-c8c8-4ace-a4eb-197c050748cb", "value": 6852072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627377237, "uuid": "fe295ceb-df70-4ba8-adcf-85fb72796397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377237, "uuid": "8d7e9d3f-5748-4f4d-b871-38a18ddeac2e", "value": "d8eb5792d969c21c364da69eca1322ab5f63e0a39b0e542bad4ee95be873c296.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2888a2-ef33-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627429188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429188, "uuid": "5ced29ec-f477-47b2-8acd-57cb65e53fab", "comment": "Malware payload", "value": "ffce81b27dd34935f5371161cc84891b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429188, "uuid": "bd8c6b0d-e6cc-41d4-9e05-6bda8fb24e4c", "comment": "Malware payload", "value": "d94d8b336a0abcfb47c21091d7e6ea47539cdb4a16c378ea3aa54ee28c15b7c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429188, "uuid": "d5985952-4564-4ef6-ad96-92c6ec2909bd", "comment": "Malware payload", "value": "a55136da4f4640bde0732f586b07e878be9d6c94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627429188, "uuid": "25e14b0d-f4b8-445c-82fc-c35682c1d75a", "comment": "Malware payload", "value": "af3323d37f5752543b538ecc8b80b8cd348f4277c25b689b1f9b5b902fc33bff86645167f3e8265e1cf8113486e3d4cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429188, "uuid": "302a9c98-0086-40b7-b6d2-f0bd6f38403d", "value": "T17D35BF9C31407A9EC4378E338994EC71F6906C669307DA0358E77DABBABC647DF111A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429188, "uuid": "3a3bbccd-2500-4149-a450-2363674444d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429188, "uuid": "61f08933-114b-4a39-a633-c819a763553f", "value": "12288:xvat43yNHZ7yLNcKe+XMND4VwJNg8lCVOkv+FSvo0jgqq/EjuuZnAsx+N/zoSD3z:8434HZ7yJ6anRVOfcvR8d/Ejuuy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627429188, "uuid": "3c0a89f5-32a3-43cf-9b00-804516d0164e", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627429188, "uuid": "9efc3ac9-aa47-471e-af11-727f44341409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627429188, "uuid": "78b2afbd-3efe-4f8d-b59a-281a98eadca2", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6173360d-ef14-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627415637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415637, "uuid": "7464493a-754e-4ab3-936a-09f1f2909dcc", "comment": "Malware payload", "value": "347134a0abde789a76239b1ae82df2e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415637, "uuid": "fa22309b-6b33-48ca-ad3e-83d16a16917d", "comment": "Malware payload", "value": "d9507158555ccbef8c0e1ea32786fa831678954876e5d54e7454243b65d168de", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415637, "uuid": "d8bb95d5-baf8-41d0-8187-79daadde0bb5", "comment": "Malware payload", "value": "56663b53bd32b12a6c4ed244f30dece6877f20cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415637, "uuid": "d2b41c33-7d75-431d-9092-71f8535bc271", "comment": "Malware payload", "value": "3423c8d3bb775f85b03dc81691683b90571d9452274aebd0eab709f4278004c25d810bee73e8e623876a719e2eadd270", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415637, "uuid": "d88859b6-e1d7-44f5-8895-2aff51ffc669", "value": "T186B4907B968C139AFE4FBB398F5CAB7FA091F7553B02D28ED5219DC16A133A78501402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415637, "uuid": "2620599f-f002-4ac5-a4eb-97b92d06fbcb", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415637, "uuid": "17739c5c-e580-47b1-9f6a-423eda06aa62", "value": "12288:HU873ntBL/siV2pVRJ0hVWI97UCAX5axhsxw4zd/XSkt8Y2EB3rYdHeo28D:HU87XtBrz8zIVWOQCY6sxw4RDH3rYd+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627415637, "uuid": "eaa6a002-f75e-43b8-a59b-ae72479c3ea3", "value": 502398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627415637, "uuid": "b3442eb6-1cab-48f0-91c0-07e302f74132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415637, "uuid": "2ead76ae-2b95-49dd-8431-5a5e67fdfd58", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1d9257-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627372140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372140, "uuid": "090bf0c3-e95f-46d3-ad48-409008c0d77a", "comment": "Malware payload (SnakeKeylogger)", "value": "9af6d69cd3b279c84b891f8ef7824731", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372140, "uuid": "10d0b5a5-5c0b-4c70-9058-b5c6b895ed37", "comment": "Malware payload (SnakeKeylogger)", "value": "daca2995c370089febb1385775ee446b2a451b363a481437bf7ab9817b3dc711", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372140, "uuid": "6800d83d-5241-405f-96d4-56a15629e894", "comment": "Malware payload (SnakeKeylogger)", "value": "f872dcb0021881e884fcbbbef07cea19a0725467", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372140, "uuid": "67266f00-f660-4ad0-aaa4-54990ed29184", "comment": "Malware payload (SnakeKeylogger)", "value": "6dc8e06446562451b2ae3938ae5906eb5837cd0b7d24c310c10d8588958aa5e34a9f52a66028b50ce8b1cb50bc2e4bae", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372140, "uuid": "0fbf16cc-d8bd-4b3b-abed-f3e9d27725b5", "value": "T184734FBCD09706988F8667B81B0F6F46018CB62DF794A672367C9B3567D1CB7812293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372140, "uuid": "2c84a06a-b3a2-4660-9741-a2e7424abb9f", "value": "384:YKj10e1ctIq44Q7Qvt3mZOSSdHRMm9unLXQlm:YKj1lcn44Q7Qvt3wO9J4nam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372140, "uuid": "596197e8-623b-4123-aa17-587f3ebeb86d", "value": 78504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372140, "uuid": "82553cd5-4de1-4de4-b849-180ab63feb53", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372140, "uuid": "7effe618-1689-45de-9d69-35d3e40d57e9", "value": "IMG PO 012807_32X.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51f870f-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627365634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365634, "uuid": "6d5a4217-01a2-4a25-8f5f-3d100909f5a4", "comment": "Malware payload (AgentTesla)", "value": "e6e9876ca73882229b9f4ef8451955b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365634, "uuid": "1d4669ea-c77c-4de5-a0c1-788ee2cae533", "comment": "Malware payload (AgentTesla)", "value": "daed3b91bf4637976a692a7887589349751cba8dc222e74aeb766132a288fb92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365634, "uuid": "bc9cdc61-428c-4114-8cef-ceb8eb4de9bf", "comment": "Malware payload (AgentTesla)", "value": "c8c61e35f44565b8425d70b35fbaf0877170ac7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365634, "uuid": "73e26310-70d8-4fc3-bdca-2fde37b45400", "comment": "Malware payload (AgentTesla)", "value": "e2c8c769f1ef05140c369bd47d303f1f6a65029f3d69880ff5c9a22554d9c4ba56e29f9d876ebbc7c3ec75383b86c1b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365634, "uuid": "4eac90a9-d82a-4299-8829-3dcaa8105966", "value": "T1FD45BEF01718EB27F46B067D1432556326E2908DCD68CB4DBEA27E8B7E613471063E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365634, "uuid": "3556aae1-2a23-4f17-8d0a-baaee17ce85b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365634, "uuid": "372fa480-72c8-4d8a-b413-157d374904f4", "value": "24576:hOOsBgo0q4wMPBmCmTOUd+L6kFXWaFpuJIZGZM9hDs09c6ywjl3478A:h3oHM5mCm6Ud+zFXxPu5MvVyIldA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365634, "uuid": "988679aa-d614-43ae-b078-95ad98281b12", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365634, "uuid": "79375996-dfe5-4c06-8b8e-ead5e8acaa94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365634, "uuid": "b28fdcbd-dd57-4e22-aa5c-6dbcce4193d0", "value": "COMMERCIAL INVOICE AND PACKING LIST - SHIP CONTAINER DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d5596e-eebb-11eb-875b-42010a9c0053", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1627377250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377250, "uuid": "1eb70752-d577-4ed7-a703-a7247be126d5", "comment": "Malware payload (ParallaxRAT)", "value": "1b890e13edc227f3605e8725fa62c4c3", "object_relation": "md5", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZOMI INVEST d.o.o.", "colour": "#44A15A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377250, "uuid": "bfe2ed30-bfaf-439a-8d7b-b7e0c9678138", "comment": "Malware payload (ParallaxRAT)", "value": "dd2b6e5b02de97b7888bb22135c2c9771c6a2477a59e96463141c36d30e80fbb", "object_relation": "sha256", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZOMI INVEST d.o.o.", "colour": "#44A15A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377250, "uuid": "a245a143-c983-4ec0-aee9-eaf397fbaab4", "comment": "Malware payload (ParallaxRAT)", "value": "65979c3b01a41b7b5939d7808d3791350b65e6fa", "object_relation": "sha1", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZOMI INVEST d.o.o.", "colour": "#44A15A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627377250, "uuid": "53880d10-e34a-44d4-b93e-2a386a029975", "comment": "Malware payload (ParallaxRAT)", "value": "62512049bd46ab6ded4bf72871316fc46c185fee4d260ca9a410199cb12c721098bd56a0fb7b017e6058217afe8e892a", "object_relation": "sha3-384", "Tag": [ { "name": "51.195.57.229", "colour": "#0536EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZOMI INVEST d.o.o.", "colour": "#44A15A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377250, "uuid": "d5e85f4b-689e-4147-894b-ab578bfc355b", "value": "T1C456123BB254A53EC9AF077246738250697BBA79E90A8C1E17F0050DCFB65710E3BB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377250, "uuid": "0d477f7d-95b8-451a-85e5-bd13c529cbcf", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377250, "uuid": "4342c2ad-01ce-421b-9e7a-9990c8d1741b", "value": "98304:BSi+jqKoeBzszaBCpadb95BnMxySiwuF8G5L9zQuxe5UYF/e/Bgmv+/qnyYTh5Vq:wfqCCpm9mNiwuFHJGaW8Bg9CyQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627377250, "uuid": "289598ba-1ad0-4487-8de9-6a81849df79b", "value": 6112720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627377250, "uuid": "51a459ce-7fcb-43c5-a4c7-ae45b6d6c80d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627377250, "uuid": "5924e23b-4920-45a1-803f-b0494158a953", "value": "dd2b6e5b02de97b7888bb22135c2c9771c6a2477a59e96463141c36d30e80fbb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d5b451-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627384907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384907, "uuid": "711ec83a-868c-4b5d-a66a-d5bc20d2fa35", "comment": "Malware payload", "value": "ed8f887ee6a77a36ae801ae4d095e622", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384907, "uuid": "33c4d6c3-ddfe-4257-b994-91b72f79503c", "comment": "Malware payload", "value": "ddbc1e8c889f6bde9cf03694a0b2069cb6b988225cb8dd125411589997feb96a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384907, "uuid": "fbbfafee-7bc8-426d-aefc-2e1ac14304b7", "comment": "Malware payload", "value": "a949cad2d79aa16c7678f3fac58e7050f291afa6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384907, "uuid": "fccb070a-68e1-4841-bd7b-fecae3529697", "comment": "Malware payload", "value": "a969c6fe2e01f97ccd2dd76303188f8f002f4e59f2f76906cb28d96161dfad1e028cfdd42814f59fe14b2e53910bc605", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384907, "uuid": "349ef53a-38c8-436e-b320-98722e37bc0c", "value": "T1E9340CE4688F48B2D2499C5E6494B145AE74FEE334C5887223AFD434DF5ABF29EC4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384907, "uuid": "84fc4f43-1394-44da-b4d4-cc071ebfac27", "value": "1536:iAW7qA4b64vHvKhUix7JIqMRfmdnBurRI9XVqpRdzFz76mAg5eeVhMDw5wfLT:iAW7qA4b64PiURdzFtr5RDAw5wfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384907, "uuid": "5d98418c-7fee-4f71-b284-2632da4dfae1", "value": 234660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384907, "uuid": "337bad21-f4e7-48e2-9fbe-c4f609e8598c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384907, "uuid": "272d355c-7ef9-4cf1-8852-55460e87db25", "value": "signed SC&PI (2).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9159d6e-eef6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627402899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402899, "uuid": "dbbabb3d-85be-4af2-8350-b65bac9bfe2c", "comment": "Malware payload (Formbook)", "value": "23d890e7a25c8a51bfcec1939a20a7e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402899, "uuid": "b6524951-5913-4403-a691-b4941175868c", "comment": "Malware payload (Formbook)", "value": "ddc1d5dd3d2d2a64d1d3e7586023715a1da59c30af9682843d326e0f16f12632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402899, "uuid": "dcab1dfc-b382-4505-ac34-5e3efb1a5914", "comment": "Malware payload (Formbook)", "value": "0193e5561521c2beac81ef0e3141fe0f93f7e9b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402899, "uuid": "c186e515-bac6-4bc7-81e4-7d54c4097c25", "comment": "Malware payload (Formbook)", "value": "06cbf4c04701555e8cee0704cecb14cfce3ba9987c0d04284b6e4f0332840b057fcbe156cde0cb3a8f62de1e23d3fa58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402899, "uuid": "69a13c1e-44eb-482c-b9c9-50ba33998aa8", "value": "T145159D125DCF869EC2680DB69731AC5682314DBA2949F3132EC174EDD93F2EDC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402899, "uuid": "acb73e61-440e-4b69-91e6-22411bd66b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402899, "uuid": "af45fbce-3282-4047-a66d-e67dbd886211", "value": "12288:e/3H1YpnkcZjJp5pXGylqjU0S5rTjIKqas1W0VfTCJtASMPQipP56:63Wh1p3XGylq4xbqasQcfsipg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402899, "uuid": "8b2d0ec7-9b14-49b5-a5ef-5aee4070bcfe", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402899, "uuid": "20b14274-4ebe-428e-a43f-4e8a3299c34a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402899, "uuid": "731dd158-94f8-4835-8ffb-5eca1bf4d446", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efeee7f-eec9-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1627383340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383340, "uuid": "0cdee9c3-38ad-4b92-bfc2-4ffc9575e352", "comment": "Malware payload (RemcosRAT)", "value": "f3ec2ac5f8cd8dfb46f3a4d14acc4c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383340, "uuid": "34318813-9b31-4b9a-82b7-ef7c2ce38790", "comment": "Malware payload (RemcosRAT)", "value": "de2346e7683a4ed34d62a2954a38949335e6c1b27085a1cc82c08b0c6aec514e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383340, "uuid": "958850e2-675c-43e4-a10b-dc1b38d9698a", "comment": "Malware payload (RemcosRAT)", "value": "45cc84a525944b49a77bb693e2cc6f9e38e7d27c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627383340, "uuid": "032bdf74-78db-4c7e-88db-318fa3ae8284", "comment": "Malware payload (RemcosRAT)", "value": "f355e4067660e3e3f2d1962c6b2715b9bd44faf35373798986a7c92c242520e5a635d9ff2a58a40a71c19253ef0bfdf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383340, "uuid": "b2b11f70-d970-4bb9-a75d-e7aa9e3b8f81", "value": "T1E8543A335E11A46AEB455F7550A5D33B53062F04354B8ABF31CCBFAB7B74B83A4A8212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383340, "uuid": "d6740b8f-10b9-4a7d-9b95-2cfe2b593411", "value": "5d381009aa02642f69cd0e68c8f0d91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383340, "uuid": "2777d18f-a050-40a3-b05c-08c4be911dc4", "value": "6144:YDq5Bew/EF3ZSblslZpJJH6Rq+RgHrAfkYb3uMlJDslZlv:oq5B03ZuuJJH6Rq+RgHrAfkYb3uMlJD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627383340, "uuid": "e0f312e6-0017-49a9-b041-ddec03d6f804", "value": 300776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627383340, "uuid": "b47eeff2-8ff8-4fdd-b8a0-d091e0881d7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627383340, "uuid": "f158ef18-bfd1-40fc-9761-cd7834e3dade", "value": "Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df53a1c-eeb0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627372655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372655, "uuid": "f45e1d91-a34d-4677-bffe-9f21e1acda1f", "comment": "Malware payload (Dridex)", "value": "b7cf2052ee1681f71c9eeea22d44e3e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372655, "uuid": "ff5a2498-6008-4c89-939a-77de45d3c695", "comment": "Malware payload (Dridex)", "value": "df7e4b16f900d23eb532fbf32df859b7bb554ebf738efc81da09642d873e523a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372655, "uuid": "a8809259-1f89-42e2-b124-db75806e0f48", "comment": "Malware payload (Dridex)", "value": "48e3aa45c9929926e31a0ef938da61345ea1b922", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372655, "uuid": "93780eb3-094f-4394-bbe4-b8dfe2357d6c", "comment": "Malware payload (Dridex)", "value": "5514c744ed3b7ab4b061b2b0fe43797be6069111e542a8baab60964419f27e3781ed5de8cff3de74a10e45c4e6f2986a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372655, "uuid": "6f72edb6-d0bb-49bb-8f74-b254a02c819b", "value": "T1BB7412C9E0B7C6DAFE5B00BB79811FDB9A533D224AEC80B4E331617DC415F6E2A84195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372655, "uuid": "72287187-b780-4e97-bd40-cd0d23a3f67c", "value": "6144:2ECj+sWRo6tcJhv7Bzg+8h6F493OzNStilXE1HoSAE9:2EC+Zenzdl8OLzNStfP/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372655, "uuid": "a2aa2e71-7f14-4ca3-874e-28f3e3fb5737", "value": 339871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372655, "uuid": "2f717897-2553-4a96-9446-8237e395b3af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372655, "uuid": "43d7700a-d02c-402e-a1d6-40bcdfc8163a", "value": "Invoice_42365756.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00d436a-ef2b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627425755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425755, "uuid": "bb1019c0-68a9-4517-931c-6ce8f4ee2478", "comment": "Malware payload", "value": "3b0856696acb8270f0b35cad85b0520e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425755, "uuid": "54e5d7ad-e4b1-45b9-b25d-0c99e3148e0b", "comment": "Malware payload", "value": "df9d8b2795a0c694bc4109aa303ffd114d221cbfbeddcd2400b89d5fcc010e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425755, "uuid": "a83110c5-6b39-4c7f-8a07-820992b01d38", "comment": "Malware payload", "value": "bcaa7b5f8399599cb3c98c0f3210729276b01a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627425755, "uuid": "43eaf961-7eaf-42d0-94b1-e701df355880", "comment": "Malware payload", "value": "14c4cb4123b434b8a990fcee69861f6731904fc77ec3de635a1492a2b1440911badd96ed481f64be91102d759224e5e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425755, "uuid": "8da319f6-0f6c-465f-b8be-0876fa8f8f45", "value": "T17CC49FA6BA5394B3D25273BC8C1B7769A911FC4029B82C8736F4FC785B7AF813215187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425755, "uuid": "5e226e06-e41a-4969-bc33-725d238e7fae", "value": "b72347a2968bb32befc95cc909a67f1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425755, "uuid": "b83efb88-c396-439c-a62d-213214927859", "value": "12288:0CyAqPpF+twTE3p37yjpRwn4d/x8cTX22ERKa4:0VOtwTSun7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627425755, "uuid": "5698bbfe-cbdf-4618-a7f0-27dc87f08004", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627425755, "uuid": "efcedf2c-33ef-4e7a-838a-f0912aa1c4db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627425755, "uuid": "f6a08d34-212d-42a6-8106-1d447b3a760c", "value": "ENGEMED P.O OFF0027307,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2493271-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627372072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372072, "uuid": "403dae04-4eb3-46b0-a813-bdc07727ab05", "comment": "Malware payload", "value": "db32b0c156355ad8516ff78f89ae62b4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372072, "uuid": "c8aae190-0d3d-43de-98eb-d6d5b16f95af", "comment": "Malware payload", "value": "e00d0795913f70c6b4c955e8b7c1285cc8374c3a5b265402628ff411c05c4740", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372072, "uuid": "bd945e7b-b287-402c-834b-20117c559b4a", "comment": "Malware payload", "value": "2e159a1c0b291b5e058e238cf4a81d8c7c61a64c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372072, "uuid": "1e1012a2-b0de-4c8d-a555-3c71525389c5", "comment": "Malware payload", "value": "cbb6809b8a70a3cb21e292146bedb77623fa06b01995ca63e4fba0248a918bd4e9c5b1915991435214e2791e4ef09106", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372072, "uuid": "6a19f0a8-f3a7-426e-a51b-13342cd60730", "value": "T16A51EAAF352D6811EF0B51D74EF9FD2E9AE7300A06DB20CA309E974103A27257A23857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372072, "uuid": "19d5ccf1-6cc6-4337-b5d0-2a3acf03f6f2", "value": "48:3Xr674jny+hlo3t3/lyjklJLUPkQX9e33ij+YgMV+HWDwqJDqqE0WHmnWH:LDnplCpNhJLUPR9eHZYzdDDqq9WGnWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372072, "uuid": "0ff3a091-b1a4-4d6e-a608-d5d8b9bc59c3", "value": 3163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372072, "uuid": "3a71caa6-f942-4c13-9535-06dfb493de33", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372072, "uuid": "e54a1659-bb76-4afa-9e3a-95f4e2f69f6d", "value": "Revise Invoice Bank Details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716b75a2-eeb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627375721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375721, "uuid": "cabeb7d2-ca4e-4166-8c19-842d54067e24", "comment": "Malware payload (Dridex)", "value": "86a156d545f23e81be35433443bb6da2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375721, "uuid": "d14d824a-2357-4e82-9fda-50fe4869d8cc", "comment": "Malware payload (Dridex)", "value": "e08fa4239a4c5ed68a5efd79953489da0ba5c3505c19888be83533dea837f99c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375721, "uuid": "4dd10b07-d268-46c3-84e1-02a28ddc9d8b", "comment": "Malware payload (Dridex)", "value": "c5df03d08806f1faa990ea3a71ac447aecc7185c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627375721, "uuid": "5f1745a5-c7f6-4c91-ad1d-de4973542865", "comment": "Malware payload (Dridex)", "value": "d2bb48e981078057c43cc104e118f2563317575e56819cdffaa154e158f3362f5bc34f8129f291334b0f0ba2c6888c73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375721, "uuid": "8e761acb-c612-4932-a0d6-fafa73039f7c", "value": "T15973C0C54E921346D3F81832C306EA78854F742B2773DAB68C62A309055E5E236FF57B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375721, "uuid": "9c593633-26f1-4f8d-91c7-e7fce1102fd1", "value": "1536:RqC5NWdYP2Li3WF0w+rJxYwGNTfdgDYaBzvKnisNJWqJoOFMc:RqHyui3M0wi2pgDBgWq6OH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627375721, "uuid": "13feb661-6fca-4d28-b753-700882ee0a13", "value": 74783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627375721, "uuid": "0155e737-dd1b-42e3-aa34-7ceddf1d11d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627375721, "uuid": "ebf5379d-55ba-42a1-9a6d-22a8facbf544", "value": "Invoice_020634.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccdba55-eee5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627395712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395712, "uuid": "44031600-0774-4abe-b909-93332176b5a9", "comment": "Malware payload", "value": "ce7cc2464827f79e9d51810890cba926", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395712, "uuid": "431917e2-42ab-4ac9-bbb4-9434d32f5809", "comment": "Malware payload", "value": "e173845977339c3fd7e017ecd1af96b4c0ce59fcb2001a683fff639c4ba824d8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395712, "uuid": "545e8234-6a8d-489c-a11d-97b0047be7ca", "comment": "Malware payload", "value": "aa727a33ca7042b76180cb26af402162343ca6b0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395712, "uuid": "d9fde599-8a7f-4a48-a5b3-d57a16c1d2e5", "comment": "Malware payload", "value": "d478f6f6f6b57707a530aae710817e3eb14ecf8642d59dcf5db8ac1f671a839810ba58dabec3b4639b2092e4a6fc47f9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395712, "uuid": "14d57acc-66f0-47ce-a175-adfb3f99f1cc", "value": "T12A34FBE4688F48B2D2499C5E6494B145AE74FEE334C5887223AFD434DF5ABF29EC4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395712, "uuid": "d72f79d2-c8b2-4144-94fc-5fad24440de8", "value": "1536:iqW7qA4b64FVTDuhrNnlwrnEYo9V2A0RowKxvVCpBdzFz76mAg5eeVhMDw5wfLT:iqW7qA4b64FwvrgBdzFtr5RDAw5wfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627395712, "uuid": "db6d4ff0-adf7-4945-94a3-e43706fe74ad", "value": 234652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627395712, "uuid": "cdb3f5d6-c462-4568-972a-b21a5b060bd3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395712, "uuid": "b0c03d04-4e3e-42d9-8c35-f006c35d7fbb", "value": "REVISED P.O.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c02cef4-ef1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627418232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627418232, "uuid": "5ddfc296-dc70-4b5c-919a-1a98df06fda3", "comment": "Malware payload", "value": "5d57a40ff54e66f72b06f0c581d2163e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627418232, "uuid": "4a7989d2-efd1-4d24-b60c-9b49988a01d9", "comment": "Malware payload", "value": "e1b8ac04414e9c6ad5899d525e6c8a7bafeccde2fb255fe4ed23c24afb721da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627418232, "uuid": "4706aeb5-212b-4ebb-851b-6c63a54200c3", "comment": "Malware payload", "value": "81c4a3c92234aeb9cc42c379327b7e566653d18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627418232, "uuid": "0d5b532b-4f1e-4414-a799-3c61a1597718", "comment": "Malware payload", "value": "7783924fa59258231323719ba028257a49c820daf04accb7b2b41592505ca5e3018e4c84c96a520fdce795006a7b1a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627418232, "uuid": "1d2ecdbd-afaf-406e-9d0d-8fbe5977de5d", "value": "T1F8E4E179332BA348ED34CBF91C69E5A267BFA029662DC6380E44D07DBD7277C1AD0542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627418232, "uuid": "fcc2a15a-ac3e-4037-a9bc-cf82a6b13a4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627418232, "uuid": "5459ad6d-3c6c-42c8-93ee-547a234c7c42", "value": "12288:+2fyvUIZbV8xjlU5YipooAtsvsbiulvdFDYAEgByOsqb3Ds3MOf+/s:jqvDB8o5yoAtsvsbiuljVkOsQ2MO+/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627418232, "uuid": "0bc4abc4-b42f-4574-9044-91798e490246", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627418232, "uuid": "2af8976a-67ca-4b33-99b8-8c2b22262b35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627418232, "uuid": "f4bff03a-e939-4734-9c5e-0430ab9977c6", "value": "z2tcOyqI7985wOo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16328cb0-eeb1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627372991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372991, "uuid": "8673e011-4638-4036-bd57-e064a376ef75", "comment": "Malware payload (AgentTesla)", "value": "371fd6aeafdcecd9cd4d13681fc60e75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372991, "uuid": "9be43683-2248-4d49-9da4-b3c057f0a5c3", "comment": "Malware payload (AgentTesla)", "value": "e1cb7d89b224add8c1c019b849e4e27db5cc138596091354e441c3c039cc35b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372991, "uuid": "89bd2fcc-f4ac-4da2-9549-ea77cd8bd9c8", "comment": "Malware payload (AgentTesla)", "value": "5d89e76bd8469d27f95b06209c2615299b5c8117", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372991, "uuid": "cf6920cf-608d-4b66-83e7-1d749020c728", "comment": "Malware payload (AgentTesla)", "value": "84f4b344ff04c7db78e6f29f4c6de534785efa52630c5761232a8137723d5faacbe12e4fad2846880c41b70b75b89644", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372991, "uuid": "e3f8823e-5562-4524-9913-459ef62e733d", "value": "T14DF4CEE5163C7B0FF0AF0B7D907140225BF0909BCA6ADBE5FF6304EAAF1569B1051686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372991, "uuid": "5b185748-f24b-47c9-8ace-ffc434b21e10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372991, "uuid": "d0077cd8-05d1-4531-818a-7d40b88968e3", "value": "12288:2xZPU97PU9GEYYHwpcZtOsBgo0q4wMXLKCF0cKf3KeA/6jFWu4GNo6Pc2u/MYSPN:2xRZtOsBgo0q4wMX9W3eyguxNQPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372991, "uuid": "ebeda864-aae6-4d3e-9a36-31fd96c2ff71", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372991, "uuid": "7d2ec972-863e-4e71-ab9b-cb8374ef9a40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372991, "uuid": "9b3f3cf6-14b3-4666-99a1-80bac3b5092a", "value": "371fd6aeafdcecd9cd4d13681fc60e75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95163b9-ef17-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627417181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417181, "uuid": "63e25d07-5691-495f-b5a7-81fa83305b0a", "comment": "Malware payload", "value": "f6b430cda92dd026e96e7d304d20db43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417181, "uuid": "4fd85435-34c5-479b-b1fc-032a76181c5a", "comment": "Malware payload", "value": "e1f620a49978341460d102aefd71b13a0f3d36aaf8dfa042844984ad6dcfaa7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417181, "uuid": "3817c7a0-d937-41d0-bd7b-b3543348d099", "comment": "Malware payload", "value": "701f788e29b0a9640e53c826cd871f3f9fdd3160", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627417181, "uuid": "a687a22b-7bad-418b-b5b1-56cbdffa227f", "comment": "Malware payload", "value": "77a65cedce0f9ac37c68fd1fb5643b8a688043cd31215029a7d83f159f464eca8ee381ea05ef472e57cf9d6f0a3d6127", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417181, "uuid": "757a48a7-ebb9-4b57-a15e-7f55dc22600b", "value": "T11DF4AE413184EC8FD0175DF248AFD82062747DAF8526D60F3A87BAAA95DF342245B78F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417181, "uuid": "f7121e89-49e1-4a54-94c6-a6dddc2023cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417181, "uuid": "a8a62bda-b106-474b-851e-04c207bb0dc8", "value": "12288:wbJFZafPBzvR9dLtccRptMklMEKb/iL+xa7/k3SityjKY:sJFZaRzvRJccRptMkqESa+dHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627417181, "uuid": "f8c8dc42-ce52-4864-9d9e-893354382299", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627417181, "uuid": "f77568fe-85f4-42fc-b729-b7e735dfbe0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627417181, "uuid": "61003244-1465-42b1-8c12-fad37674b853", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66089f76-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627384721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384721, "uuid": "fc3c2f6c-eaaa-4a51-9e11-d3a2c9219d85", "comment": "Malware payload (AgentTesla)", "value": "ff5d0a2b5fa45ddcdb3471236adf7b9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384721, "uuid": "9a3f5b06-9bc7-4ccb-a6f0-acd82c366bb3", "comment": "Malware payload (AgentTesla)", "value": "e352fd57db8a0670353e1c3caf02fd7d83fb315bb2e519b48dccd27eb3a2c456", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384721, "uuid": "9e3edaa2-9f99-4d03-9ad5-b42de460e67d", "comment": "Malware payload (AgentTesla)", "value": "9d03755918f0b8c9bc7436b96c480564574bb446", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384721, "uuid": "edf8214e-03d5-49b2-9718-2b63b83b8433", "comment": "Malware payload (AgentTesla)", "value": "3d4a17138d050daf870688008f1ecddca336bbe5e61d443139c6f8ba68d2d69bb5442e795cca35eb33f7ae5d28e3364f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384721, "uuid": "1eac9a25-03ac-45af-97ee-59ef99ae6519", "value": "T10AD4BEF83639375FF483847E54B05CA269A054FAC96EC792F33341AAEF1C49B9940297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384721, "uuid": "141e91ec-b57f-4216-98e9-f2ef816a5c81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384721, "uuid": "75748649-4808-4fc8-a740-f2d83fc23b79", "value": "12288:WsH4A6bE6XU+qBBAWJCIzk0kwM8kLd5rlUjPF7Z4gx79OfF5Jx2VncswAb7mo5oi:WsH4XXFp1Iz2Zd5xUjPFqA9Ec7mo5oFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384721, "uuid": "7a2adf65-46ff-4fa3-a290-b26ce48b2e6f", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384721, "uuid": "d490dc1e-c98a-40c0-8a17-f8418d4e15e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384721, "uuid": "bb0ddd42-d4e1-4961-8676-cb4e52511c98", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe49c4db-eea0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627366079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366079, "uuid": "f01e1694-595a-4cf9-9a62-caa5f43f1882", "comment": "Malware payload (SnakeKeylogger)", "value": "2a092edc584bcc0adba934f6d8806db1", "object_relation": "md5", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366079, "uuid": "70aaf8d3-20d1-4afc-b5ab-773786f66cd6", "comment": "Malware payload (SnakeKeylogger)", "value": "e385e3e9cecff341f6cba6e62e5c7540f52469cb7711633e378c7caf76ffe748", "object_relation": "sha256", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366079, "uuid": "0a056819-1169-464c-a6ef-f1ba847ac13b", "comment": "Malware payload (SnakeKeylogger)", "value": "1106ee3131b697938c53096d6786fa4aec8c9cf2", "object_relation": "sha1", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366079, "uuid": "cd61115b-5521-45f2-87b4-e7602f9e3f4f", "comment": "Malware payload (SnakeKeylogger)", "value": "1cb8d4b103c9e7856e3f9e3b7603d850a92945ceeb3fe8046da2151c6a9945a0cedd479eb3dedc29d06ff5d83d7d1577", "object_relation": "sha3-384", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366079, "uuid": "1bcda4fd-340f-4550-ad45-14da193ab293", "value": "T111A4232F4506340D94BC6688C9FC69EF7B0C8AC0D62E5383AB9B45E924E7881E17DC2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366079, "uuid": "35ee34c6-8c51-46bf-afed-6fdd61418b1b", "value": "12288:wX/un4WbNhOn14GNdvmkLTVGLdqAay0sDs2oy1:wMDLOn14GnmkLMLM7s42oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366079, "uuid": "80c1f867-6c98-46ec-8ec4-abf83f3f8ac9", "value": 452970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366079, "uuid": "d3bdb6dd-d36b-4913-84a6-3d6914cfd694", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366079, "uuid": "d574c6ff-9457-4615-9d15-9eb3be3bc979", "value": "PO#JFUB0002 4QjPQ2oE-pdf.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b5172d-ef15-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627415920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415920, "uuid": "3d964bea-b916-4282-a10b-8790bed3582e", "comment": "Malware payload", "value": "54cd3832c1ab9889d0b3741292a0263b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415920, "uuid": "ca2af991-b0d1-43ec-980a-1225cf8046a5", "comment": "Malware payload", "value": "e3a371bfc3dd3560f5bd27f023c137e5b2c7bdba80c5b7f14a69f393cbce047e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415920, "uuid": "33c57daa-cc56-4e27-bdfe-08eaa20c8ff4", "comment": "Malware payload", "value": "c855ad13ab4cd135d1e04c10524a4f06a2007654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415920, "uuid": "ba35c4f9-b64e-4f59-8772-dcaea82af602", "comment": "Malware payload", "value": "64c244d7f1707af56bc8d2c200786b5b6220734395be21e55b008fadf343425a2997304f9d10880afab3daa12a1b9a10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415920, "uuid": "73165335-7e96-465e-bb29-b910a7268411", "value": "T1FC354B2AB303D080FD7D14B2CD90F7F4065BBC2BDA0E5E1716993E92747B66B1A7A046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415920, "uuid": "b69c88fb-82ba-4395-b1e1-5dafd0be6a15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415920, "uuid": "21d6cd16-db09-48a4-8c2d-39e5d30112ea", "value": "12288:S8E5GxNJ+1D+4plTNWrh2/hVFty9pArFdmQ1syaUVKnpY1:SH5GqD7perhgVFi4R1zahpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627415920, "uuid": "f0bf9572-0898-467d-aa2a-9fbf69a1bbc4", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627415920, "uuid": "9b9e21f5-4956-42af-b1c0-d8e986b16e18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415920, "uuid": "dfb82584-ab42-470e-822e-dd4560e450da", "value": "367006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968e4858-ee6d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627344000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344000, "uuid": "2a49ac47-0a67-4716-9efe-7de1909b5d58", "comment": "Malware payload", "value": "abb435b69b1eb882069a3d291930e25c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344000, "uuid": "7e6565c8-ffb1-41d6-b62a-af40a754825f", "comment": "Malware payload", "value": "e481e934466d3e768442331a3c3af50c4d430b6ed14059afbe661925338ef531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344000, "uuid": "f8d681b8-ca9b-4d7d-8fb1-508cb5ece788", "comment": "Malware payload", "value": "c6b5679ff6558b7861f7e9430a24c4980d99c5e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627344000, "uuid": "20d43259-0e84-48b7-a6af-2f807b0cb126", "comment": "Malware payload", "value": "3f1c1d46d21b2a4cd72f195142ad1e0f3e80ed40d2f0a3b3190b8fab63d606a58214f08496ca93cded76a71e4309ed08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627344000, "uuid": "d4a1ed02-9ce7-414f-9fc3-248fe6862dc3", "value": "T15FE2CE12A7E4C021FD3A8D771D7327054679FFA7484289BE45CA721BED7160ADE80BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627344000, "uuid": "32b368b4-b065-4625-b698-57a6cc7099b8", "value": "768:rFeGzM5DPVKpvRikddCGTckAXZFqryfQF9L1qB3xuB:rFUpVSJzddjTxAJFcyoF9L0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627344000, "uuid": "f6cf11b6-c9c0-414e-82ed-cfa2dcd0a99d", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627344000, "uuid": "ce3f1ef5-d3a5-4aa8-8b79-4775459716c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627344000, "uuid": "52d3ea28-3ae7-47b0-9597-deb190b5c750", "value": "abb435b69b1eb882069a3d291930e25c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9920c8bd-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627400698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400698, "uuid": "ca47f660-4d7f-47b8-bf1e-d9a40c76f2ea", "comment": "Malware payload", "value": "1daac0c9a48a79976539b0722f9c3d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400698, "uuid": "c10e53c0-0522-4714-83a3-dd19fd2892ed", "comment": "Malware payload", "value": "e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400698, "uuid": "c5ba6c2a-04df-45ce-a507-b0022ac7dc9c", "comment": "Malware payload", "value": "843218f70a6a7fd676121e447b5b74acb0d87100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400698, "uuid": "37bedd9f-8e20-4285-83e3-6dd50089ef2e", "comment": "Malware payload", "value": "e8d6bf2bfe2836cb6bce31beec3bc2a17d596906aa3c5bb79c22d740d8ce85105c2428afa0e99c272d7dcab1c6825f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400698, "uuid": "1d611e59-b5d8-4df8-aaaf-8a94dc26ffac", "value": "T14434E31272653FA4D1E14A39F543CB55CF253F270620576B66233EDA3E2E7D38C2AA21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400698, "uuid": "d3bc7d33-d561-40b6-9a58-5fcbea3a5a23", "value": "ab97af8ff8cf7ba1bdb7c1c70e46000e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400698, "uuid": "92f27082-8014-4872-be2f-8764948ca823", "value": "3072:vSaSOtsPAka3/SyOfSw61/tVbAONOn2kvGTbvEOFAE37XzKWL3ZsN37XzKWL3ZsC:vSRFM3mk11NpSO/Xz/L3OVXz/L3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400698, "uuid": "16f48d07-c9c8-4db0-bd73-8e61c37ec070", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400698, "uuid": "3c2fa373-4c93-4a67-ac57-b736c4d3df3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400698, "uuid": "a894c73f-a472-4e33-8a3b-377fb90ceaac", "value": "1daac0c9a48a79976539b0722f9c3d3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397c4a3e-eec4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1627381211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627381211, "uuid": "2149c548-2b20-41f5-891d-fc76eade1c54", "comment": "Malware payload (Gozi)", "value": "50668987522bf36f5cc66a3770778e98", "object_relation": "md5", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627381211, "uuid": "ef8b1c06-1c2c-4b1e-af2d-15ab2186b21e", "comment": "Malware payload (Gozi)", "value": "e4f311d6481be913af69d4acb42bd57eae057edee962d0eca183abfcfac410e5", "object_relation": "sha256", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627381211, "uuid": "f2cf7b83-659b-4604-aac5-4db3b803bae8", "comment": "Malware payload (Gozi)", "value": "7f65a958b0c3e430d5be463b0b925972a9798fd8", "object_relation": "sha1", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627381211, "uuid": "3f4da5f7-2a68-4ea4-96c9-a08579a1499e", "comment": "Malware payload (Gozi)", "value": "94382c6c5a9107f9eac42a70cbc60d74ae4525d6aa08f088cb817bc38d3001a426abded82b01b8e965f4d6916f12525e", "object_relation": "sha3-384", "Tag": [ { "name": "F7272021", "colour": "#E29AF4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627381211, "uuid": "8cf93e16-1b42-4d46-8e76-f4e38e1a95ea", "value": "T11532D142716F9FA7E1E340B7B877660702B3A4EB634389D5D114BE84F34905E470E676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627381211, "uuid": "05ded9e4-6c2e-4b08-b850-890e0ccb8f91", "value": "192:v+xXYLHvkfuSt94918KaebpRfk/E2uXizdj6j1DQICjFQeQ5AOQfv+ETbJv+KQww:v+0Hcu9918KaebfWuy5mj1EIWF6Or+sA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627381211, "uuid": "a77c5a15-57c3-4372-8dd2-2a4bf6823633", "value": 11935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627381211, "uuid": "e5ecf884-c26c-4f2d-b4a4-a9d613ef354b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627381211, "uuid": "a5a5e56f-7c18-496d-8647-87cae9164044", "value": "form_documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8aa375-ef03-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627408272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408272, "uuid": "7a9d77b3-36e0-47ab-9ec5-e57d44fa680b", "comment": "Malware payload", "value": "95a82f3eb6b4bfab230779e4e8afe42f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408272, "uuid": "28b6aad8-13f2-4ce8-87a5-a7ad082c085d", "comment": "Malware payload", "value": "e51033b63bf3a77604f76f2b863b0dc1f4c86d936c807c0201ea4c24950b91a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408272, "uuid": "dfae8bc0-5be4-4c89-8504-a3ba98cbcf86", "comment": "Malware payload", "value": "02dede5b6fd16a83a91066fa418baaed85a96bf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408272, "uuid": "128f29e3-81c1-435b-82b1-13c1310ae259", "comment": "Malware payload", "value": "192f14cd2bba045fc9f9db9c20d3645731297dfded38815d16eb2a051c25125d422baadbcccf44bbdc5e2c6e6de588f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408272, "uuid": "f251cb98-36f8-4370-84c4-4629ba46961c", "value": "T132A423301782FACFD1A84E31E36F455A8D7243A72B5E90C1F9D4219767B2601DB6FE22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408272, "uuid": "37fefa88-1d3b-47ab-b37e-c704eee01214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408272, "uuid": "3d841490-d327-4b7d-8b98-cb7c5d7615a6", "value": "12288:HYUld2Dcgqx4MT5h/uMkvF81+KeD7Vhj5S:4Ul3HkvA+K0fjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627408272, "uuid": "5f6f0fdf-d5f3-40d7-8996-14f4730a8019", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627408272, "uuid": "d2a7f31f-07b6-457d-ab44-0a876f4ea33d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408272, "uuid": "1d21f5c3-caea-4c25-8e42-ce31aa27cc2e", "value": "95a82f3eb6b4bfab230779e4e8afe42f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26585c98-eeeb-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627397929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397929, "uuid": "df64a491-c82d-4964-83ea-4aa71ae09bdf", "comment": "Malware payload (Formbook)", "value": "8fc8a4252b32c8eb4b9e03b018ff72a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397929, "uuid": "cd4c4942-da25-4dca-9534-6290fdada21b", "comment": "Malware payload (Formbook)", "value": "e59a1d022c6c4f0cc7d23689004e65ea7f1f940adef98cf891a008dd9d7f66d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397929, "uuid": "427f5620-44e9-4a8a-ad8b-e3c87d771071", "comment": "Malware payload (Formbook)", "value": "14a7a0b55043b430cbcb0a94b26a4f33c3f7d3d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397929, "uuid": "23bab4b9-7a2b-4391-afe7-2b3e3e605459", "comment": "Malware payload (Formbook)", "value": "cb15216c5ee93768963a6f2d298a5fb0fff7bebbb8dc3b351dc8932a2e53dbffcfd1347da754de78fb70f1f6982358d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397929, "uuid": "2589798d-6e4a-49d2-b022-c3eb6f1ea499", "value": "T122159D525ECE865FC2684DB69731AC4682314DAA2949F3132EC174FDD93F2EDC89F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397929, "uuid": "46b1e568-8147-4c02-b765-6ea98ae230ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397929, "uuid": "9b54dead-1961-47de-8c94-bea27563e912", "value": "12288:YYwTqnunUHUGMAmxF8wdEmoVG6bzQAoJ+SMPQipP5q:2dU3A/dxx6kipQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627397929, "uuid": "46fca719-10d1-4e14-be58-003a5e95ab9e", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627397929, "uuid": "2919a2b8-b240-437a-a336-ad29cdadc80b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397929, "uuid": "816bd741-b60b-440d-b823-7510c16ec960", "value": "nWVjpM9ao5s78s3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41274c55-eef4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627401839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401839, "uuid": "edd337d0-ff7a-4da3-9a10-684787e27dcd", "comment": "Malware payload", "value": "274972e4b6fda5bfbb6edc56cc53535c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401839, "uuid": "66683981-790f-4f10-97d0-848a87896689", "comment": "Malware payload", "value": "e5c6631198046a0602fab8a55b3c8a455e6f08a4aacd84b5000c7dac6d5cf6f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401839, "uuid": "d99e38af-9f51-4be5-a4b5-95648b6f91e8", "comment": "Malware payload", "value": "e3f8865ac2b967ed92aae518e3b9d2bbd5ac5a09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401839, "uuid": "e66ba332-2b48-4df7-b13e-d9defeceee3b", "comment": "Malware payload", "value": "2a6c11b70c717dbee0c925d0f70df0480a2a6935ff3a24036d71e47e77126fa453e20dff4291152aaaacfacc148a0f55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401839, "uuid": "41e0e014-300c-43cb-9b2a-121c3687daca", "value": "T190D2D165A18F59E8C22A64B23DBDFC2909A4E2185960D5F7EECCC231E057F312B55613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401839, "uuid": "6b45b91d-ae46-4ce8-ae91-e00a7d4c0e38", "value": "384:MNmdVPr9d02i8JZVodJAckEwLN9gAM9mb4ZkG7VtBZeqFCR8x7tANaNJawcudoDp:K838krNS5AZG7VoqE8x5nbcuyD7UryqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401839, "uuid": "2b9e61f3-1452-49e0-9a1d-3d91e5fcfdc8", "value": 29068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401839, "uuid": "bca35dfa-c737-4c60-8858-f6c4f05330fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401839, "uuid": "97d9fbb8-0512-4325-90a7-31654a82b800", "value": "274972e4b6fda5bfbb6edc56cc53535c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364a96a1-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627396667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396667, "uuid": "81968eda-6fa0-4f82-a5b0-d5f4a1501699", "comment": "Malware payload (SnakeKeylogger)", "value": "a79887f6a16088002da8171f306e1c35", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396667, "uuid": "a2fc30f2-672c-4871-af92-71ce8575f0c1", "comment": "Malware payload (SnakeKeylogger)", "value": "e6208325c155b89a626654ffbf06de21ef809ba583c9742952f006326fce8493", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396667, "uuid": "6748b156-ddce-4564-8ad2-7e9c48ee5d0d", "comment": "Malware payload (SnakeKeylogger)", "value": "61f8ebea354416303d5904f625255c8381852a2e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396667, "uuid": "c5a91ce9-0363-4ee1-9e1a-518b62f03598", "comment": "Malware payload (SnakeKeylogger)", "value": "6d9f06c8fe7844f7691f82b010d8ceb7f2211d9e2a1686edc73b6a84945ce215da18130f44a7c9a6a5195cbcc150d648", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396667, "uuid": "777bb84f-b274-461b-bc22-b3d629fbfae5", "value": "T16F533F6CC46742988F89ABB42B2F9F45059D762DF788A533357C6B301BE1D7A4026C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396667, "uuid": "ccb852c3-3046-410b-9c6d-3003a20561eb", "value": "384:++Vv41VYZVGno771r9LGu8BceIN58YLal3:VsgVSo7SBe5al3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396667, "uuid": "7da74976-8284-411e-964c-315f3523ea49", "value": 63631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396667, "uuid": "9206608e-26b6-43c8-a80e-7cf9cadb25ab", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396667, "uuid": "0901ac25-724d-4096-adf4-400a65350c48", "value": "DOC_scan10002.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeaa1933-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1627384843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384843, "uuid": "93a141a1-e717-420a-8f33-5ee34bc73302", "comment": "Malware payload (RemcosRAT)", "value": "4d0fbb80c91d6c74d2a0510808421bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384843, "uuid": "62025951-dc4b-4dd7-b223-bdc7b4aa76ab", "comment": "Malware payload (RemcosRAT)", "value": "e69013a3a50ffb58b54a02e4317ad21da89fcadea6d92c0ba83fc1a10d0bb549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384843, "uuid": "6f13e96e-d4d9-4478-b659-087d91cd3a91", "comment": "Malware payload (RemcosRAT)", "value": "a3bb7c3fea33c7d3ed92f9b5caf0fdcb22fa31f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384843, "uuid": "a21c3628-fbbf-49fb-8e1f-1b4816aaecee", "comment": "Malware payload (RemcosRAT)", "value": "b40c7d43dd8dc9b05a44fc8642c8361c91b62545b2c8970156d84232823edab45c467651a841e6be9d29b83d0b82d625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384843, "uuid": "5f4b4eab-444f-4b48-a3a8-beb7192d0301", "value": "T150E4026A1AF0C563C2836D795AE1E5C89B2E2E5D2D50430D9EB0FD8F7E36A0154F03AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384843, "uuid": "d72d2bfd-c190-4482-b34e-a9ec5c2ef3cd", "value": "fb3173a5f2fac421132f53c478a667b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384843, "uuid": "3df3b8b7-6e4b-4d8a-9eb3-740605886ec6", "value": "12288:lfN7RNvGsll9zxttThwZ1VFxP0/x21Py5I7VhYsUR0qePeEwcimlhPQW7C76PAQK:r7Xvpll9X3wLDxc/x21KO7VhTURifznS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384843, "uuid": "948fd68a-9e9e-444a-8e0f-5e07b0fe30da", "value": 719477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384843, "uuid": "fdd4826b-4b43-4dce-9ad3-30a674838716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384843, "uuid": "63008c2f-0072-4a59-88a6-ea299c7b6ea8", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fc4cf5-ef0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627411427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411427, "uuid": "b2dff050-628e-4c0a-9ac5-adeda4617248", "comment": "Malware payload", "value": "9343f031d3ab03e202698b5e5f7a71c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411427, "uuid": "d3da3c7f-53e9-4232-947e-1e76787b209d", "comment": "Malware payload", "value": "e7cbb9f2862c31495bedaea4648d8e76e5594c03b648ab5185129a69f6b2bc5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411427, "uuid": "7b1f893a-189e-4881-a13e-dc388b564f7f", "comment": "Malware payload", "value": "8648f8babd986618c21185705f365df9705b6c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411427, "uuid": "cb2b6ea3-6f67-4ef8-97bc-ebf4d6b11515", "comment": "Malware payload", "value": "f879596dd6765f2c4834f9efb72293c46109336fd2db81c898a081508b0cd62e28e330f4e5f390a9676df1d016f00cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411427, "uuid": "79be981d-96f3-4b54-88a1-355ca818eac1", "value": "T11F05E036231BA714ED7C47FB5CA8D05067FEA816961EC5392DE8B17DB8B2BBC12E0105", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411427, "uuid": "4e6b6c42-00bb-4508-bda2-16b2c82f90df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411427, "uuid": "29174235-ad46-43cf-9817-64698a2899d1", "value": "24576:f55NRlwCrazX80I9hOAsrYJ/9GPezahp0M:TdTro5ohOAsrYJ/sPeOqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411427, "uuid": "dc66a1cf-e61c-49be-a799-9cd9d8ae7c6c", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411427, "uuid": "8bc7b69f-50eb-4062-b06d-077373075f17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411427, "uuid": "16e5074c-ca92-4ab6-b333-04766fbb07e3", "value": "URGENT REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb85566-eecc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627384897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384897, "uuid": "041c75d2-5463-4ca8-acbc-21a65bd990bf", "comment": "Malware payload", "value": "b26cee301381a70f38b4e5662abbaba7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384897, "uuid": "b8927d3e-a34b-4a41-aa31-dd4af9747643", "comment": "Malware payload", "value": "e8a3d587827e4971f80107e3bf3ed908dd4a53d78f550f695d2617256225d442", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384897, "uuid": "02015446-2ca9-45d0-9630-54cd42ff1d79", "comment": "Malware payload", "value": "ce05486ed48b2f2afe3462417501042c4d169d11", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627384897, "uuid": "dbf0b8d9-c97c-44b5-aa89-c6c14badf00c", "comment": "Malware payload", "value": "6b8de10f94734b302ebf63419908092d9cdf2129419cd3f5f4a8f29361f566980b60f76f50cc8b43ee900e24b3c48454", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384897, "uuid": "08ee57dc-ce88-4b79-bdae-eb0854be68dc", "value": "T1E434FBE4688F48B2D2499C5E6494B145AE74FEE334C5887223AFD434DF5ABF29EC4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384897, "uuid": "a841f98f-a99f-4730-958d-f869af78b184", "value": "1536:i6W7qA4b64rJwDyEFHa6gBJ9SdZoxsWV10xBVDpmp/ldzFz76mAg5eeVhMDw5wfv:i6W7qA4b64oqdz/ldzFtr5RDAw5wfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627384897, "uuid": "133abd6c-f5c2-4123-961a-1ac7f166d242", "value": 234668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627384897, "uuid": "f6efa468-3fbb-43c5-841a-30285b46ab8a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627384897, "uuid": "e99678e0-6216-433f-8cc3-5e820a3019c8", "value": "ATL signed SC&PI.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1467c40b-ef0b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627411643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411643, "uuid": "514c90cb-ee70-4c54-b2df-206e641b32a8", "comment": "Malware payload", "value": "e2e01c7a8e323e117cfc9c4cdf0ad1c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411643, "uuid": "2bf6c2a9-8de5-4bdf-9907-615b67887b13", "comment": "Malware payload", "value": "e8b4e90cb7a9233231088d027c2c090aafc143c77e1f46d34d6b206c2c797419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411643, "uuid": "c9f6cff4-1d4b-47c0-a436-478e9b607010", "comment": "Malware payload", "value": "ea718bc482d968f9db9577b8d9edb08e4f24abbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627411643, "uuid": "7de5f7e6-a054-439c-b9d3-74f498dfafa9", "comment": "Malware payload", "value": "bd607e4aeca6333d98204df5bec52351b91d25c454962b0674e0fc6fb2e40d18427048a85d46352b33e9af6ae289d0e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411643, "uuid": "7d161d29-1e48-40b9-858a-bd28f466678f", "value": "T1C615E12622179204DC3883F44C25D5F12BFAAC2A663DC27D2AC4BD7F7D736B85AD1581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411643, "uuid": "c23a5281-ea5d-421d-a228-a1718f049171", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411643, "uuid": "6988fd9e-a209-4efd-9a33-fd5ee99a1246", "value": "12288:BGUVpyvUIZbVlBPI2VBPaBP5SaSv1Ty11If+zUIFxicJfqP6QG:YLvDBlBPIOBPaYau1Ty11QCigfqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627411643, "uuid": "24bfb808-1d16-4636-abba-5afe89a7d7cb", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627411643, "uuid": "01f560f5-6b95-4f43-a7c9-77691763705d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627411643, "uuid": "419579d8-c886-499d-945f-2856c2a49ddd", "value": "SCAN_Wells Fargo bank payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850afa84-ef12-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627414838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414838, "uuid": "b9ef22b4-b88d-4ed4-8f29-5e3f28439ca8", "comment": "Malware payload (AgentTesla)", "value": "4767054a1b8210baf87d01af18f428dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414838, "uuid": "528c211e-1127-40b9-a304-ca37f30bebc9", "comment": "Malware payload (AgentTesla)", "value": "e8c4c52fc84b28da5711b4913aa57d206e31e3f7f0f089cebc2b632e20e84027", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414838, "uuid": "e79b0353-01e0-419f-b0f6-fd6593f5b89e", "comment": "Malware payload (AgentTesla)", "value": "bc465fe25171f3f8c1bddee36f62ee768e8faf7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414838, "uuid": "89829a38-20f1-44b2-a1d1-f40a36369bb8", "comment": "Malware payload (AgentTesla)", "value": "c0a9a5a3bb83c40427dd1037681ec7cf52ba0dd75d747cedf1a0305ce419c3d55191b743da9916a433bd9241f7b4e3e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414838, "uuid": "c6cf8f0b-1a30-449f-80d6-6957911d0b0e", "value": "T12805CF25F227A704DCB4C3FB185891615BB9BCE9B21AC7396E98B0FCB87363865D0711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414838, "uuid": "a82a0c48-831c-4a9e-8f74-0d6bf84a1c8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414838, "uuid": "caac28a3-ffb2-499d-b3be-577e5dca0a6a", "value": "12288:YixG9T5uj6VXpEhyo8kzPfYHg5UOCPmDaj7Jjt/P91+wZ5tmkTllCLyaUVKnp:rGl5O8pSzPfDsm0Rjpgiltahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414838, "uuid": "635cc2df-71d3-47ec-bb46-802831dfd4c8", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414838, "uuid": "48dc0823-912f-45f9-863e-92e54bf68ecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414838, "uuid": "30b2ae4d-e81c-48df-a44a-e931da79446b", "value": "9PynloBGqHebwTI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59d6e76-eef3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627401605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401605, "uuid": "8b924b48-ec72-4c09-a2cf-a2e52a2ff11a", "comment": "Malware payload (AgentTesla)", "value": "e458f4c8559099c18a18e5ee20effb62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401605, "uuid": "1ca07f4a-fd18-4d3d-930e-1d387ffa301e", "comment": "Malware payload (AgentTesla)", "value": "e9e38da2056d6738c63eceefe9351446dbfe92fd6d8651924875ef97af9efc1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401605, "uuid": "d8d82017-30f0-41f6-95d9-6b5cb55f4b8b", "comment": "Malware payload (AgentTesla)", "value": "e453882d7d6e754ee9641ce6fc587a2d2b8e57bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627401605, "uuid": "6725d7b5-bbc8-4429-8cb3-59000a5947e2", "comment": "Malware payload (AgentTesla)", "value": "0613c24b9c523e6bd47a91e2fcdc24e095fee0e3fe8d00d0fdca413005ec11dd7908343a13defe4b92149a00a2690e51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401605, "uuid": "734c047a-e425-4b19-ba99-641211dc9165", "value": "T114D459BC355035AFD633C873CA64AC10FEA064A7A307CE07A153059B5E0D6979E4DEAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401605, "uuid": "9305e2f0-56e4-48f5-8845-159f36c9a35a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401605, "uuid": "3fcfc9d2-3a16-4fc7-b0c3-28450d026584", "value": "12288:XgmldYV3YPzI+uMygZ0NbGovMUqLMZlzrmS5bKnx1H6/do:XgmldYGPzruMyeA7qLMZhmGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627401605, "uuid": "0f03f429-d792-47f3-8cf5-46e456d0ba73", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627401605, "uuid": "c6032a86-86c9-49a5-8037-7ab2261bbfc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627401605, "uuid": "b115b125-afcb-4507-846c-56336a46f43c", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed7097f-ee7a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627349464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349464, "uuid": "15a7e469-1410-48e4-a738-02ac207a8166", "comment": "Malware payload", "value": "f4217eea477c2bcef9f68465077b08df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349464, "uuid": "7406f6d6-38d7-4f31-8a60-712ce0005f7d", "comment": "Malware payload", "value": "e9f988c03da8b6f0e8b7e6d002385233ef72a7738a8ec4310afdd32793dfa9bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349464, "uuid": "b174f96d-adf0-41e8-b868-3b4c1bb3b36c", "comment": "Malware payload", "value": "0effa53137cbdbdafd5d6065c1bb503faaf0b9ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627349464, "uuid": "9b293cbd-e25c-434a-a5ad-e07c9a9df172", "comment": "Malware payload", "value": "f113b9d5e992e672e4aaf1a738e317a8b6eba2c3af78076fe5bc0bb14478dc7b9236ff11e4c675386261ab3f8367fbe2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349464, "uuid": "66d12edd-63cf-444b-9b62-49a9bca82be2", "value": "T1CE255A06B8919F52C6C036BAFA2F539573270B58D6F6F30699144B383FC799A4F3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349464, "uuid": "95f1911c-150d-4d85-a5c4-44907b7a037a", "value": "12288:vf54iYqmS4Mh2pIzp37Pe6MoQUNpjfekSEw8v1fqgPv1nc4yG5x9uNKxf2uWgcsQ:35nEYdFNpbekSEw8vDukxfRFc3WUQ78n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627349464, "uuid": "64d8a771-27a0-4253-8ad6-0e404fa884d4", "value": 991604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627349464, "uuid": "63375c73-476c-4de9-8830-786b38224099", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627349464, "uuid": "5746284e-2035-4a2e-9ba6-74803246d7fe", "value": "f4217eea477c2bcef9f68465077b08df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aae3692-eec2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1627380461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627380461, "uuid": "d79dd1b5-a3e4-42b2-b451-6aa1f5690c9a", "comment": "Malware payload (Gozi)", "value": "e1828e14dfd433feb070e600b0c4735c", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627380461, "uuid": "73da5da1-ce66-4f92-992d-376ab116059c", "comment": "Malware payload (Gozi)", "value": "ebc055181b92b6dd58b9f126cb4274b48cf1cfc0a5de46d811505b44ee4fac85", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627380461, "uuid": "292746a5-adc8-495b-8986-643f5302c2fc", "comment": "Malware payload (Gozi)", "value": "15ee934a25e6b0a3494efdb287a3735170de4321", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627380461, "uuid": "22bc39fa-2081-4d1d-9e67-76788bb981a8", "comment": "Malware payload (Gozi)", "value": "99634784f89f08533f4c453a006edc1c524bd81c6dea63c70afda6cd1109b3e7328455e94e272145aa3c6762bb425107", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwRM2021OSO03", "colour": "#12C8E2", "exportable": true, "hide_tag": false }, { "name": "RM2021OSO03", "colour": "#85F697", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627380461, "uuid": "935e5e9b-89b4-4a9d-a7e2-b96b7114cecc", "value": "T1B932DFE6ECC9731C40DBF6EA28DE52E1C1DD2B9868376CD78B592279311E448CA09FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627380461, "uuid": "40aec638-ee6b-45d5-ada9-a8d9f679d4f1", "value": "192:mP4CxT0S5UucAop0w7NLHKM5nU1tzi4XUDmZqNJUNQjewAir4VjwhYa1:ExASn5opP1HjUfi4XUDmAva0A3Vjxa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627380461, "uuid": "be31c8a6-8100-4801-b2f6-b0510b5b0ad5", "value": 11943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627380461, "uuid": "c120ede9-15bd-41bd-8f31-a171ab37af26", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627380461, "uuid": "2dfdb2ee-428c-4667-818f-6e457116fb68", "value": "RM2021OSO03_1591706_1_5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c312cb82-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627414083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414083, "uuid": "9a75ea14-63ce-4e96-90bf-9587bddf6dd1", "comment": "Malware payload", "value": "c0853f1c286493bac050426c11ac7134", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414083, "uuid": "616740fd-bee8-4774-a005-e83f513a5c30", "comment": "Malware payload", "value": "eccdc58f3ff38c4382bc1f9a99b78b246795b176a117755ca2193487bf977778", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414083, "uuid": "d63843ac-0126-4703-9f20-af069060b249", "comment": "Malware payload", "value": "8c2968f39bb536e453957a025a901b09c03676c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414083, "uuid": "ce740f60-7139-495a-9471-c7df7d56960e", "comment": "Malware payload", "value": "d65c310338082d3e41787f37c00231ddcc29936c5293a4f9bd99025fc359feb5461a7bb0560f418d6e2b0c598976d09f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414083, "uuid": "3735f527-b895-4f1d-b747-e6e6852683f4", "value": "T17293734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414083, "uuid": "cc34e351-8f37-4b49-8711-6c83a8027800", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOb3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414083, "uuid": "c929a214-e26c-44a9-8608-74321a1e8db2", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414083, "uuid": "a75af9a5-ec59-45d2-a94d-b346b4c6e8ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414083, "uuid": "b65e4c05-33e1-4e7d-8e29-1dda1eedc2c9", "value": "c0853f1c286493bac050426c11ac7134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27855494-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1627371731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371731, "uuid": "f221f74a-c2ab-4621-8b8b-de1eb80db353", "comment": "Malware payload (NanoCore)", "value": "15eb68a65e9ac7367a6e6bdf51eee30a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371731, "uuid": "fc7b0449-87c5-4dab-820b-2a261198fdd6", "comment": "Malware payload (NanoCore)", "value": "ed60103a8a1837ed4691670a5307539ec832cf3ad076d6afe3bbf06c84ad4511", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371731, "uuid": "383c2b8d-4340-44ea-91bf-69b6c72876e1", "comment": "Malware payload (NanoCore)", "value": "d988bf603a28bcb2c031f00101ee83509c0bce1b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371731, "uuid": "201b37e2-1f6d-449a-87a7-ce1f49d6abde", "comment": "Malware payload (NanoCore)", "value": "818a47b2e2e56f8a06d238cf6f0b073580b9b3911f9d975b323e2dc7072821bf39c9e56e5a5020c232ffa7e9a19f1cab", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371731, "uuid": "5fa7d435-5a7a-47be-a7e2-07cb9a5a3e4c", "value": "T12434FBE4688F48B2D2499C5E6494B145AE74FEE334C5887223AFD434DF5ABF29EC4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371731, "uuid": "9b2f9db2-91cc-41d7-b18b-dfaece92bbae", "value": "1536:iqW7qA4b645VTDuhrNnlwrnEYo9V2A0RowKxvVCpBdzFz76mAg5eeVhMDw5wfLT:iqW7qA4b645wvrgBdzFtr5RDAw5wfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627371731, "uuid": "6ddffc35-5dde-44c9-9785-e4ce03e95e3c", "value": 234652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627371731, "uuid": "cae15ca9-f64c-4dd6-82a1-3d409aebe595", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371731, "uuid": "a1b180ab-b399-48d3-85cf-debf9442ba23", "value": "Purchase Orde.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7112379f-eeb3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627374002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374002, "uuid": "35843b74-5ffd-4a83-8c51-277eb403f9d8", "comment": "Malware payload (RedLineStealer)", "value": "3302857b60717ebb848d9b14d7bcf14f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374002, "uuid": "26093a01-345d-4f7d-8400-7a20c5d3be95", "comment": "Malware payload (RedLineStealer)", "value": "ed834c43c24a468fbbdf46fef36c44e0979d996b8ce1d6c16f4f39323151519d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374002, "uuid": "4085f9ad-3631-4003-98f4-fa778a8a511d", "comment": "Malware payload (RedLineStealer)", "value": "4964a1f1a04d0896cfbd4d198f674a44b202aa54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627374002, "uuid": "8d01fdfe-a3fc-40d7-bda0-41426b34188a", "comment": "Malware payload (RedLineStealer)", "value": "9adf69c57725cb388cc8019ff9d06f12726e837319932b781bfbb5d19745c033392088ff3032c0aa37935bfecffa1eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374002, "uuid": "b09c905b-6df0-49e1-b43d-873312f286c2", "value": "T1DB7449BB27990806CD2F83F6B9B85205C374E962D1CFAB637CD591FE1C3A398A5402D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374002, "uuid": "38c2de81-8f29-40da-ac99-68fa1958243e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374002, "uuid": "4b0badda-5e6e-4c56-9b3a-4552b3947e15", "value": "6144:UEloJO8Z4D5nUnKWX1g8avpvEHThymABm/9meaWgG1:VKkAUn6KWX1AvpvYhy/8/9mmgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627374002, "uuid": "6e6e3567-4564-4104-8d0a-eaf7b484a7eb", "value": 342408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627374002, "uuid": "9d9f1f66-d61a-412c-b562-5df3373ce861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627374002, "uuid": "5d995389-cb2c-4fd3-a4c7-7531c3e6809b", "value": "Run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a50029b-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627366233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366233, "uuid": "a5045af5-74f5-4334-9055-9d37365390a0", "comment": "Malware payload (AgentTesla)", "value": "bbed19abf6b369658b6996317e2e2067", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366233, "uuid": "897d13ae-95aa-4bb8-8b65-dfe6fdef2ee2", "comment": "Malware payload (AgentTesla)", "value": "eddc270558f27cf00441f9056ca98264e14708d8202647bb461c371e6db85cdb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366233, "uuid": "923e8081-b7de-41d7-b817-ee27e4158fb6", "comment": "Malware payload (AgentTesla)", "value": "b252760938e016ea408efb75cab44defa95a6b17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366233, "uuid": "425a32fc-f03b-467c-810a-e17b7cb5f528", "comment": "Malware payload (AgentTesla)", "value": "60d75d8e5972b6d79fb9731809fc315b1dff096f9d28fc46863d137993a435aed668b979a08fd0843a3400864895e8b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366233, "uuid": "d5777692-494d-4013-a25d-3e54664363d3", "value": "T19CD458AC315035AFD533D873CA68AC10FEA024A7A307CE079153059B5E0EA57DE5DEAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366233, "uuid": "4a166e2d-66bf-49d6-998a-540a33baa8bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366233, "uuid": "52300263-126d-471a-be0e-27d1fd8b7129", "value": "12288:XveLBT4EhJaiTCy+x+qPzubHPmS8u0RI3MIKQ3GLOir:XveLykaiTqDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366233, "uuid": "84fe7019-c660-4f55-9a19-2b3cb1688be5", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366233, "uuid": "d2702bea-17c3-4c49-971d-d8bc31b1b08a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366233, "uuid": "ee43d51e-bb8d-4ba3-a713-dbc7d7c76ba2", "value": "MRKU8781602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35aa1a8e-eef5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627402249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402249, "uuid": "d16ed6df-50a9-4214-959c-df3bd2cb1e2e", "comment": "Malware payload (RedLineStealer)", "value": "215780b0ede9fa802540127e703d19db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402249, "uuid": "2369c2ed-7eb7-418e-b057-3374d4b85e2e", "comment": "Malware payload (RedLineStealer)", "value": "ede58b194ccbae4f7791de9dc2dff85077c69065061d44585e7f2410efbca877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402249, "uuid": "97ef00ab-4715-4077-944e-5e6def421d84", "comment": "Malware payload (RedLineStealer)", "value": "21b73769af967c94bc9ca2ce734c60ae858d12fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402249, "uuid": "c10264f2-b2d3-4d42-91ed-88f8a48bbab2", "comment": "Malware payload (RedLineStealer)", "value": "a1f69847aa1f0d9500e337dd282a6dfe45f27125c16c642f65c30020a70f5a9f45e49f95dff3573e7b4c454364526d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402249, "uuid": "8b6f2f21-fe90-42f4-9580-20ae4fd76692", "value": "T1B714AE6537589C7ACA6E2F70110313A15A319D4B7A11FD3823FB7138DDAE7C9680E29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402249, "uuid": "6b34b0a6-3345-4fca-a6d0-4d31c5f45657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402249, "uuid": "cad291fd-897d-4237-8a33-b467e6255a6e", "value": "3072:PTjHRYy1ytHd8VBoWJ0ILe7kOL5HsQNRJ0OPq3ZsWhJ7AX6MzmrdQAzTJ8/vHUVG:bzRS5qLoDued5sQNRhiJsWj7bMETJ8/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402249, "uuid": "6d03da14-b3e8-4d46-9a0b-779c9211a9c0", "value": 195792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402249, "uuid": "e11298f4-e44e-4cdc-aa33-0eeebf35d415", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402249, "uuid": "47b5e212-a329-4947-b5e5-3df6daca9ce1", "value": "215780b0ede9fa802540127e703d19db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f50ab5e-ef0e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627412923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627412923, "uuid": "c51a9ee3-c618-4c2a-8cb3-81324829985a", "comment": "Malware payload", "value": "04ce2f0ca28c875383e53ba18fab1f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627412923, "uuid": "12b40315-7b4e-4a47-a1b6-c33f7495cf34", "comment": "Malware payload", "value": "ee0ce73cb38775e87e2e1e7391bd333a950027577b4bd3213422e396ba4ff3b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627412923, "uuid": "8a4142bd-cdd0-4fbb-ae8a-f95eb39f1944", "comment": "Malware payload", "value": "9b4b84d26cbf6c411ed8f4b862f3e28e4aee5a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627412923, "uuid": "c9ef5461-2c73-438f-97f6-67566b9c3536", "comment": "Malware payload", "value": "c0deddb71768fcd16d59fbefbef4d7a1053d46a5109e9ccae923cb9b921fa7b3e86af728d7e5a969e54b52f55ae5f106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627412923, "uuid": "0f36f3b7-99d4-4f3b-a2a8-eb73fb60b70d", "value": "T179B4F148B750F69FC12F8E76D9905C70A67064B7570BE383288726ED888F79D8E161D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627412923, "uuid": "1a7ce30d-3ccf-45de-a012-721cc2038d07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627412923, "uuid": "272de7fb-79dd-4202-b316-9b3fc123f042", "value": "12288:cJ5XFjgWkXZQhyNWpCiwmoITJf+5bMaD5Ba9T80Ao5KTK:K5SXcyPiiSf+1MO5Ba9o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627412923, "uuid": "8fdd76f0-ff76-4b1d-8d1a-99b154801e00", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627412923, "uuid": "5e5179ed-0e45-49cd-b266-1daf67bd0d4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627412923, "uuid": "2cf9aaf7-ac34-41f8-8ad8-5cbf31b879be", "value": "PO CPO_9785677-1 (ITN 095784).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71b0962-eea0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627365986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365986, "uuid": "7f0d714c-5aa2-41e8-80f0-33b1364ea93d", "comment": "Malware payload (AgentTesla)", "value": "4a6340eeab6b7c8b6d9fd08db4c3ebc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365986, "uuid": "59fec801-23ae-49a4-bca6-8333ce92cd72", "comment": "Malware payload (AgentTesla)", "value": "eea242ea0738fd80692f38a8dc59faf17555d717d110d04b32d542c4ed9fb9a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365986, "uuid": "c15fa232-55a0-4b61-887f-ec2c7bf91cd3", "comment": "Malware payload (AgentTesla)", "value": "52d1962f0a99aca2ee1bac502f170d38569ca5f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365986, "uuid": "9efb8212-ac93-491d-9fd2-87e0a08c1ae0", "comment": "Malware payload (AgentTesla)", "value": "477a8bed792344f7a41622b40da00153991b1c14c934974cd897e4f1d7ca70eb7799f4ff6ce4dee9c3c160c169f009db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365986, "uuid": "b1a0d1c3-e2cc-4093-8338-1d964439f852", "value": "T17FC423D6F0111DD65CA5DBD1274E9B01FAF2CF0550760BAB23B923EA6A7CCCB9390858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365986, "uuid": "cd91d422-99eb-45a3-a5b2-fc32be28f204", "value": "12288:J+kdDCRQnznVI6w04F+JmPf2rl/KE8LVAI8DTDGCDgilHlBHxGKR:YkxKQznVI6w0g1uKpRQHiM1XzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365986, "uuid": "dfded7ac-790d-486a-97f0-b64cf0c65bc5", "value": 559451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365986, "uuid": "bde79a80-19df-40a1-9b45-db9ee26eb646", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365986, "uuid": "f94923ba-2991-44b3-835f-b5eb02178c3f", "value": "invo5514155.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3761f7-eee5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627395709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395709, "uuid": "ff3fcdbc-ae44-43e4-ba22-96884e8bc2b5", "comment": "Malware payload (Formbook)", "value": "fef57f1f8bc2bc336fa0fe4f1d5e3f30", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395709, "uuid": "627b3818-a660-49c1-98bc-a7c507cf3b72", "comment": "Malware payload (Formbook)", "value": "ef5b81d7eebf08ed869799e9022ca82ff0a5c781b72bb6652fbc1fe7f0e4ebcc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395709, "uuid": "625cc237-40e4-40af-a9dd-ce0155398455", "comment": "Malware payload (Formbook)", "value": "c0169f4d359c5e889d6dc19a3559e1a4dd8bacc8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627395709, "uuid": "ee8647ac-debc-43f5-bfe9-0a6eb3aee66f", "comment": "Malware payload (Formbook)", "value": "609bdd4d0b44a503ee3a1983ede9cd5340baa2fa09df1a73ab287068f319c682e06446305434a79058e2ae85a21898df", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395709, "uuid": "6441b218-aebb-4c01-a3fd-ef7f941cc3dc", "value": "T11D356AD441CB1AF3F1CD3A541A50F04E572AA64E50914C6A2B2D9FE4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395709, "uuid": "766a3bb4-c782-4f75-95fd-f1df2c8b3dc5", "value": "6144:QVcVx/qxUC2LEctZ2b7B/u43mWZ2bBdzFD1RDAUwg:MxUC2LEctZ2b7B/u43mWZ2bBdzFZRsUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627395709, "uuid": "94d26903-a450-4935-ae9b-29b6dac4dab1", "value": 1068191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627395709, "uuid": "6a0b6a53-9dfd-436c-9803-2e576c690212", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627395709, "uuid": "f968f126-f253-45f6-9350-f11d238465dd", "value": "Proof of payment for overdue invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce1bfa8-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627400517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400517, "uuid": "9a4306d8-9c33-4de0-87b6-6ea2dee033cd", "comment": "Malware payload (Loki)", "value": "9f58c3a016972b23245035213c2d914c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400517, "uuid": "48467bcc-706d-4c00-89fe-e2944659c593", "comment": "Malware payload (Loki)", "value": "ef9f101dde3bdcfdb7e80989c152290d02a58a9853804fb7b691343b1d18cd5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400517, "uuid": "01ed3a1f-7df3-4e13-9909-46938525979a", "comment": "Malware payload (Loki)", "value": "35bc5fc2b0a11ac1f96240b0016d01951c979500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400517, "uuid": "031c06b5-d18a-4a57-8161-288fa712c9b3", "comment": "Malware payload (Loki)", "value": "35120df4b61cf484322e9fd6ab664d9e59918b32f86929d14cd95984c535ee2545929a4c71afdf084a58e3c0625eb9b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400517, "uuid": "f37bce1a-bb61-4d9e-bf4a-a784f5eaeb7c", "value": "T105358261068FC7BFDA6B13B0082C049C95FBED29C209F979BE1E4C76B562FE5013A585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400517, "uuid": "f67d91c5-1364-4654-bfd4-7a1b48b4622f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400517, "uuid": "f393557a-73d9-4a6e-accf-43bbc922a651", "value": "24576:I3R6aEK2aCW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqW:5LNciec3jfBAVhRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400517, "uuid": "ad2ed179-6283-43de-8636-7bedb227f43e", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400517, "uuid": "6bf958de-f252-447c-a566-69ed699f526b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400517, "uuid": "fb9bbdf2-ae49-426a-a9e1-1c28804a657f", "value": "9f58c3a016972b23245035213c2d914c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac96254-eebc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627378072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378072, "uuid": "4138a109-ecdf-40c6-b3bf-aeb1a2728ccc", "comment": "Malware payload (Mirai)", "value": "7f7aa784693f66b647e25e4835e29b90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378072, "uuid": "ec185018-dc3b-4a76-9db7-52bcc1a7ecca", "comment": "Malware payload (Mirai)", "value": "efb76405d62c872439440fab360e0c3b6f405fa3e5800efa9cf5781e0c99dc3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378072, "uuid": "b5053f15-2bd2-473e-ac67-702bf3425b3a", "comment": "Malware payload (Mirai)", "value": "439b88186abcf7f8768bbaeed8a583f349b05574", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627378072, "uuid": "7e4b270a-51b2-4cb4-887d-8966111d5b0b", "comment": "Malware payload (Mirai)", "value": "71ed8f4fb5a09adff11ac13ef095ed0707155b41fab8e0d3f4583c2149ef8eb87fcd9bd6d69ba13811c9a660ef951e1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378072, "uuid": "ae1a1dd0-a89a-4518-a977-6a4f2d03e05d", "value": "T16423394273180943E5661EB1383F27E0E3EFFD9022E4B5866A1FDB858235E325546FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378072, "uuid": "4d032664-b06b-4b0d-8cf1-5e43cf9378e8", "value": "768:LjS1XNFRpYIZt76difAUgA4IMEAu1fkXaITU:HS5NHr+0B8It1MXHTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627378072, "uuid": "2086d543-8482-4170-8000-aabb0c022095", "value": 46052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627378072, "uuid": "0422ba7c-2bdc-4b06-9bd4-40a3ff611ebe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627378072, "uuid": "4e7793f8-d817-492b-98f4-fa03b20348f5", "value": "7f7aa784693f66b647e25e4835e29b90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c05b07-ef03-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627408511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408511, "uuid": "f9d1b946-69be-44ec-89e2-69686f6bbee4", "comment": "Malware payload", "value": "b240747d8fbaa74195f74cbe5e145631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408511, "uuid": "4f531f1b-6558-4dbd-93d8-e8dc9e13f635", "comment": "Malware payload", "value": "f21b6b2a502aaa3fc73e5a0d7b208f7521d07b33e75a46810e2cea0bb7d520b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408511, "uuid": "afcc3a59-0162-4a2a-87db-f5f03e07be90", "comment": "Malware payload", "value": "f5f07d73e5c94440e7a33097a1f695f830984d0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408511, "uuid": "e28e0c1b-33ab-456c-8ef6-ccfe612cabb6", "comment": "Malware payload", "value": "853be3470012c78633c832f81a8f1e776210702f7bc22eed35e149d386d58b293086d0e5a488a94afeb30bcd81466b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408511, "uuid": "d2454be6-18f6-4c33-80ed-ed6afd64f075", "value": "T13A736A43B4D1D472E5B219325874D9B09A3FF8215F61DE6B3788123A0F305D29E36EAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408511, "uuid": "973369cd-687b-49b0-ae08-1767e1c3b563", "value": "b92d097c5052d43fb2fab62aa8574af8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408511, "uuid": "8bf7b042-1b38-4c60-a19b-296ade988785", "value": "1536:yZTR0eiXuxZzFbeS8HKjuVtzG1FjnmX9i8jnF1CaDsWPScdeP0Pnn+QH:aRDio1FbeSytzG1FjnmNi8HCqTeP0Pnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627408511, "uuid": "d8d7f80f-5b43-4ed4-9330-6da39d9bd04c", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627408511, "uuid": "cdf1ca25-de8e-4719-8f40-18cb1567dd3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408511, "uuid": "f1ac009c-b5f1-4a72-b140-55a8d1a389ba", "value": "epilepsystuffidk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85330645-eeef-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1627399806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399806, "uuid": "1b8adf15-36db-4d4c-a721-029d219986a4", "comment": "Malware payload (DanaBot)", "value": "2c269d932b52ff71a1429e94cd020c9f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399806, "uuid": "5425956d-733a-4b6c-8384-2743035da3d1", "comment": "Malware payload (DanaBot)", "value": "f231fc321d5bfd7623b731251d4231ebd317916507696795ce0a091cb8e4dead", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399806, "uuid": "2f296c53-9a88-44d6-baff-7c708b7acbd7", "comment": "Malware payload (DanaBot)", "value": "4de5a5fca618479c84e84f27bfdf589b692a5bea", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627399806, "uuid": "e4a16f13-6cb8-464c-9691-e4c2bb8c190c", "comment": "Malware payload (DanaBot)", "value": "3385785693720ff40cf60962069a8128325c3bff47e80f96a8b9a5cf49dce43fdccd2087490da7351f50be1aba18f250", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399806, "uuid": "7e8f7fec-3d42-4528-b9b3-0748ec191611", "value": "T1F445123077A1C435F6F212F859B5A6ADA53B7AB0AB7440CF52D52AEE16306E0EC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399806, "uuid": "68e99824-f4e7-4419-a1ea-48fa997954ec", "value": "fbe702755e2fb4e20a84826fa92fd750", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399806, "uuid": "40db76dd-0cba-41fd-9cd3-865152673661", "value": "24576:dHTYEG8wB1j9pMKDe+TJ/IY3G+VYbw8FcIF4aWVTS:d3g9pxDpTJ/IUVYbw8FGaGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627399806, "uuid": "3ba5a1b7-bc85-4945-8f5c-8bd3edc639ee", "value": 1237504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627399806, "uuid": "8ab2bf8f-f23e-41e3-a135-cd40017d7b35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627399806, "uuid": "2f4f45fd-538e-4843-aaec-79bc8694f717", "value": "2c269d932b52ff71a1429e94cd020c9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef35d07-ef14-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627415606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415606, "uuid": "9f5de2e4-0ae7-494b-a597-a2558ccc0aa7", "comment": "Malware payload", "value": "6f91a99c25ae0ba4dbfc5fe127c7ee36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415606, "uuid": "5b84a0c6-67ce-4115-8321-b0ebba52ba9c", "comment": "Malware payload", "value": "f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415606, "uuid": "5f5b7242-7488-4839-a61c-43f78aa074d2", "comment": "Malware payload", "value": "1dba39475d7a4279009b87b117f683c398f8245b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627415606, "uuid": "62a695c0-6b2d-4652-838a-df4c64b237fe", "comment": "Malware payload", "value": "b0456cdfcc5c2feaa5f043c239cca7b634ad3584db99ccf3cae3b814fbe88e23618e09ec8998cd70701bbc84094c4be2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415606, "uuid": "11807ba6-3322-45a5-8e1f-3410c5f0365a", "value": "T140C416AC315035AFD633D873CA646C10FEA064A3A307CE079153059B5E0EA57EE5DEAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415606, "uuid": "b95925db-2c42-4ab7-9b2c-8c79286de739", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415606, "uuid": "a557b18b-8b50-4151-a921-a46f4800bd90", "value": "12288:rq6RxLoPap9ySv/HnNIGrbqMzkDVqu3yf9mb5LFS/nJzr6:r3SajyS3usbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627415606, "uuid": "7169c749-4dd8-44b1-b264-7e373934e66b", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627415606, "uuid": "beae59e3-8910-4d86-956e-a9a15d697648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627415606, "uuid": "e781c9ac-55d8-4cbb-bfae-74fdbc64fbbb", "value": "4mjt6fCkySAbsm1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb0a8b4-eedc-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627391527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391527, "uuid": "b85ffc59-4d32-40e5-8aef-dde8320f76f0", "comment": "Malware payload (Formbook)", "value": "564508cbfae2c08aec669e47219f9b00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391527, "uuid": "febbe93d-8a99-4cd1-859d-fba7c7f8dc77", "comment": "Malware payload (Formbook)", "value": "f27c4430f40881602df511b48cd0704e0c4050a0ef1d8f0b920f8b7d0da77b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391527, "uuid": "1e50c47a-948b-4192-963f-e3b9afeb09e8", "comment": "Malware payload (Formbook)", "value": "36f867db04e9f8a9c9b585df26ba1f4391a0ccbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391527, "uuid": "064c1ba5-4b62-4c3c-8a75-ccb4b5981df8", "comment": "Malware payload (Formbook)", "value": "c2b685b3f92368ae51abed643e5bbbe2afcbae1598148892144b5ba4be50b54d2aa61af6baa82cefc2be86e770a2558c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391527, "uuid": "ee281db3-43ee-4cdf-bb2c-d0b1f60ff32b", "value": "T148D448AC355035AFD137D873CA64AD10FEA024A7A30BCE079153059B9E0DA47DE4DEAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391527, "uuid": "f9c0b0e8-ef8d-4344-ac64-df59e4ab797d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391527, "uuid": "0bbbfaf7-2829-4be1-a87e-f20b080c9bbb", "value": "12288:buAfiG2zVQxaZ9NE+g3pTCrIq6J+5SvYvXIo+CHz1FZzPyimdcEp:6AatzGUcuMCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627391527, "uuid": "1a5de82b-3f75-4010-a222-10e9b14c8155", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627391527, "uuid": "e664a06a-177f-4564-9562-f0268b0f2e8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391527, "uuid": "d98f38fa-3b3f-4e4c-976f-0e9306e76afa", "value": "PO_098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8173a9e-eee7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627396428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396428, "uuid": "892605b5-35ab-4727-a64b-b44c3a7e90aa", "comment": "Malware payload (AgentTesla)", "value": "9988685bdb69c34939c270df2eff6d47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396428, "uuid": "07bb0327-01a2-44a4-a787-fc3eec4fd6b8", "comment": "Malware payload (AgentTesla)", "value": "f367ab08d8884ebda2ca7101fa509d1216f66c9e788d1b729ce605959f2f57ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396428, "uuid": "0a8aacc7-b974-44e7-afc3-179daa10c94b", "comment": "Malware payload (AgentTesla)", "value": "b4aa67fe963f14a8ac6220d8953960a86d7bcdd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396428, "uuid": "99ab2ecb-51e0-4aa2-b17e-5aca995d1e7e", "comment": "Malware payload (AgentTesla)", "value": "348a6771287b7f2ba984eedd5e3c6911f14a6fe775827a29c7e172bdc080479560b4cd4077fd71ac8a12c54d7fa7f859", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396428, "uuid": "0f47e371-fac9-4d7c-9f58-730de74e7bed", "value": "T1BD1505371410607BF9D179F2E1D8D776ADFA08812E25BC0983DAAE871F26083759DE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396428, "uuid": "be79a602-a99c-4eb5-a84f-956012d5c61f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396428, "uuid": "33c94e29-886d-4378-8ce4-c3c3fc929d89", "value": "12288:YiVzmIU4pPleu6hEi9IHM6ZEcYUvoijcSp5hsLpLUz36ab8eo0WM/zH:YNwx81+vs6acvA0cS5ipLU2Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396428, "uuid": "108e2905-6af1-4610-bc08-4dc94c3749ad", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396428, "uuid": "c1eb24db-7eed-4b8f-a9a1-e4b321c6cbc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396428, "uuid": "1d1ccaee-a19f-49e3-9437-9278ca1b8809", "value": "fda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2271b72a-eeae-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627371723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371723, "uuid": "11310a32-dee9-42a5-8191-5e9181a4b06b", "comment": "Malware payload (Formbook)", "value": "21b9f05eadd859677d470f1eb6d961c3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371723, "uuid": "eb50954f-70f7-4024-bc6f-fde04e80ca53", "comment": "Malware payload (Formbook)", "value": "f4d9e5ddca3444e2062f930675c49dbd3e1a73e3936b326a8edfe7090ce16b98", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371723, "uuid": "d0ef905d-d90b-42c5-b137-2218cd61f781", "comment": "Malware payload (Formbook)", "value": "de601328b24e39d14dacb60ebe53cd47cdd7adda", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627371723, "uuid": "f8e62f25-0d8d-4fb1-a86e-41cf3aefa153", "comment": "Malware payload (Formbook)", "value": "b14e4e45d038202e9f1db5f57d954d505e7d1b53243c9aa1f1efd5023e03e3a42c8287c98754e79d0aed47b18df11c4f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371723, "uuid": "cb4c4454-37a7-44db-ae08-d2a4966f7b61", "value": "T16C356AD441CB1AF3F1CD3A541A50F04E572AA64E50914C6A2B2D9FE4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371723, "uuid": "246ae326-3d60-47da-8da5-e26bc312ef05", "value": "6144:QVcVN/qxUC2LEctZ2b7B/u43mWZ2bBdzFD1RDAUwg:4xUC2LEctZ2b7B/u43mWZ2bBdzFZRsUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627371723, "uuid": "bb8961f4-a799-4540-8e44-4815d4a00090", "value": 1068191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627371723, "uuid": "df0476b4-e90c-4662-8659-4a859a59c6a7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627371723, "uuid": "10ae9684-dfe3-4891-aad4-fedc8c019f8c", "value": "PO819938490.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b8a3a0-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1627366360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366360, "uuid": "cf3b70df-d9f8-4be8-8d52-ddae11b16a66", "comment": "Malware payload (GuLoader)", "value": "6d3e7f8113e2b5e6e95d2a8904aa0b5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366360, "uuid": "bafe13a7-4c91-4406-aa47-b0dc4ed32189", "comment": "Malware payload (GuLoader)", "value": "f573b29cef69436db26fd86234765fd4339ac5cf716c53337c5f1f2816161684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366360, "uuid": "4e02b1b7-259f-456e-80d8-74307d0a4633", "comment": "Malware payload (GuLoader)", "value": "aa7f58b76a10a3e18aa6cd9fe253aa27b6ca3888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366360, "uuid": "a90a3ef0-4b72-480a-8fbd-e2f94607d18e", "comment": "Malware payload (GuLoader)", "value": "94f76b8fa3e7394f47171a66516f7076a21233a1cff5e1bf205dccb7fae9190f1cb05420d0eefb8d4bbc732336f57bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366360, "uuid": "33997c66-a3c3-4fd9-b425-38fef2d98134", "value": "T142C39EFE6B35A806FB81CA7D9036A460094D92DCA20D4C5B719CC794B896FD251EE33F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366360, "uuid": "2a68e621-e37c-4223-b247-17456873dff6", "value": "5662350e6437e6371e21ed5dd0f9a09b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366360, "uuid": "1c1a71b9-7b72-4be9-9d5d-1a9051d85f85", "value": "1536:cz2Cu1C/qrmNUtYUh4BMqzq8gfHMTrsONv8yz2Cu1M3hgC:q2j0/VNUOUh5qzq8g/+rFWc2jJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366360, "uuid": "e1b803a0-1e3f-4444-ad85-b1f45171ce87", "value": 128296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366360, "uuid": "5485ab48-8455-4149-86de-823888231a4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366360, "uuid": "2e534cc6-e819-4a29-8c5f-453f4402e96c", "value": "RFQ-PO758596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc08b32-eebf-11eb-875b-42010a9c0053", "comment": "Malware payload (WSHRAT)", "timestamp": 1627379147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379147, "uuid": "5f58e26b-18ae-47b3-9329-4bfbc180eb91", "comment": "Malware payload (WSHRAT)", "value": "f098336e5dbe72f0af2370678bf9be2f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379147, "uuid": "d2036187-ca3f-44fd-9c71-3d29be1a1ce5", "comment": "Malware payload (WSHRAT)", "value": "f59e56f5a8735cf57b82bd6a6c76e352edae68f40e19efd1a03cd5fe15b06d4e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379147, "uuid": "5ef12759-2a02-4acd-8c14-7de744ab2144", "comment": "Malware payload (WSHRAT)", "value": "cb7d88f11c695a4a69eecaab5ca563c2437ab78d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379147, "uuid": "8ac950b6-cbe5-4106-bdf0-8e739925570e", "comment": "Malware payload (WSHRAT)", "value": "a4ba284a429dc83271a58f9fa0fca4e37f712613f94ef7b2c8a50d10f09da5e1867426350b2d138b0cc5b20938e90f59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379147, "uuid": "44d68348-0e91-4943-917f-c6b3d2309d6d", "value": "T19825E5D229992B2FB7A3E61AC2311B23A834C3D7194B130375A53F449F6A9453EF79D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379147, "uuid": "829e7e17-345e-42b7-8f86-82b9c2bcc639", "value": "3072:OtvQrPi50yzrjCnUEsHRwi1iuQkHd2QIFdFlpvt5I:OtvQrPi50yzrjnd2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379147, "uuid": "6e60abcd-021c-4a11-b8a4-14db605950e2", "value": 1038492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379147, "uuid": "da7a5537-92b5-40d2-8b6d-b45c49563de7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379147, "uuid": "f469b68f-b5fd-49cb-9bee-af2d708a2e4f", "value": "Payment pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986dec0d-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627400697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400697, "uuid": "a4475ee8-297a-47f9-acb8-76504ae0a59a", "comment": "Malware payload", "value": "b3aa18f53da99f17dc584b35b95fde21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400697, "uuid": "9c686232-c2ef-4807-86e4-bef1a2cb3203", "comment": "Malware payload", "value": "f647fb65f0696a3d93944ea69fac8e7e131849d019344eddd6e5470528171838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400697, "uuid": "2a4ff009-1fda-4c29-9bec-fa2882c8939c", "comment": "Malware payload", "value": "fa5c3c2330d11b3f4fd16ef3d7c5a4e226216316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400697, "uuid": "488a4692-0985-49d5-a1f0-6a86ce5af33e", "comment": "Malware payload", "value": "836aad71af99b3167ed87d41985991a6ece72168545f7852d46cae4416ecb157930e4095f8caae0f4ddca903c4668272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400697, "uuid": "bde697d5-52a7-44e7-b223-2e72d78afc1f", "value": "T1F96533421F98303FE9E9E67B911DD446069CA5A347F53E40F89BBFD390A20C5588CFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400697, "uuid": "33e7114a-c760-454b-b9d1-3724c827b74b", "value": "24576:Ym/35M+nkqL0DvXikGk3dNj6lVn8JitjUV3KZC6BBRlSSqOn7/:F57GybkTjIugjUV3v6Rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400697, "uuid": "ff6dc5ff-ab42-4a91-9d39-0db0c2c200c9", "value": 1454916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400697, "uuid": "13047de2-ee8e-4081-a825-1ea955bd7403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400697, "uuid": "dcefc27c-cea2-43be-80f3-48f70b47bd3d", "value": "b3aa18f53da99f17dc584b35b95fde21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fa5173-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627366464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366464, "uuid": "2d976c7c-3075-4bd9-b1a5-e96b0ec5bf7e", "comment": "Malware payload (SnakeKeylogger)", "value": "6a11c624b323f7c78e5a3f0d46f59fbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366464, "uuid": "b439ac42-fd35-40ea-a7be-87603137998d", "comment": "Malware payload (SnakeKeylogger)", "value": "f66c718e38d68b259ceb5ca45b599645e8c569e9bcccfe2d36309f32157dd60e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366464, "uuid": "b6a32dc0-ab81-4790-8c71-9244800799b4", "comment": "Malware payload (SnakeKeylogger)", "value": "c93b35bf571a244b3bfc27c9039f5c1907fad50c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366464, "uuid": "950da550-36eb-4ba0-9450-9a9eb13e3ab9", "comment": "Malware payload (SnakeKeylogger)", "value": "a1f6d8e84c12f8cc3a9cbb0042653449f9f98f62366034cefe45a48ab61241a8cbe1277464a4015f751ed28dfb36617d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366464, "uuid": "25b369bc-d5f5-4bc9-933d-1cff9e553224", "value": "T13845BFB1091DEF22F4B706BD74625A4442B48D46C96FCB68FE7332ABCD70BC23456A91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366464, "uuid": "6a8583db-cf08-47f4-9c75-2d5d940d3d86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366464, "uuid": "9af28c94-0fcb-42b0-8caa-797b36b70758", "value": "24576:MYOsBgo0q4wMEBmCmTOUd+L6kXXWaT9Hb1lM+ssfz/y4:M5oHM8mCm6Ud+zXXlHM4L/y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366464, "uuid": "912a31f0-6419-40c1-b669-c75f582a3585", "value": 1212928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366464, "uuid": "e42ebb6c-c4c1-4901-8518-e49f63ea8cdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366464, "uuid": "d6d42434-f1ae-4cb0-8703-39c2c2a4b4f8", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363a7932-eed3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627387648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627387648, "uuid": "c524ae0e-12b9-4c6e-8837-c8421c9e6324", "comment": "Malware payload (AgentTesla)", "value": "685c1459780494df4b455e9bacafe9d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627387648, "uuid": "bbcddda9-01fc-4202-babc-6720b2358ba0", "comment": "Malware payload (AgentTesla)", "value": "f6d53d3d7e1de59bf5d2a3962ff3096c7bbec3549c366717e51bfb74d0bc4a2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627387648, "uuid": "f47c8c4b-7623-4e87-942f-0d18da9609e1", "comment": "Malware payload (AgentTesla)", "value": "a0d00088b21aecf4ed9a4b18a2b14d7f184a333b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627387648, "uuid": "9858f1b3-ae6e-4697-8c5b-5288b49666ae", "comment": "Malware payload (AgentTesla)", "value": "4b5886e9c1cfc987b2cf467dfe84498d656701d84cc763fb0c580df09cedbbfb953d906baead015469d76bc54ab257a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627387648, "uuid": "d4a351b6-9bb0-4b03-a061-dd1bff0b02e7", "value": "T16A975B9D3650B2DFC86BCD76DAA81C64EA60757B830BD203A05716EDDA0D99BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627387648, "uuid": "4047c4f1-f9af-4ce6-91c8-9650efa1e340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627387648, "uuid": "ef3566fd-04b5-462e-9657-4213fd33169d", "value": "24576:P0v0xVdMmOE2CcBN8033AGcrfJdv7OkInv4r:Mv0xnOEcnpgGWfb1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627387648, "uuid": "dca09112-7bc1-48dd-9ff6-da04facf819f", "value": 39845888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627387648, "uuid": "b2092bc5-0b4b-4099-b9eb-12510a0c7670", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627387648, "uuid": "d6343172-af0f-4e24-97fc-d263e60114e1", "value": "banka dekontu_00295433.PDF________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b5fc57-eeaf-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627372217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372217, "uuid": "946a3a42-e2ab-41fc-a310-843f58e13317", "comment": "Malware payload (Formbook)", "value": "29f0bda585a8167f6454692a90bc4680", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372217, "uuid": "9c70764c-8ad7-43a0-a769-2c6e676064ea", "comment": "Malware payload (Formbook)", "value": "f733a7388657968b77ebcf2996451ff762cbdcc6f064e11b9a3671b47c29d17f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372217, "uuid": "a406dc17-7094-4d01-9c25-f17888ccc33e", "comment": "Malware payload (Formbook)", "value": "caf70f07d7e1f5fbd3cc80976eb3b72a63a883cf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627372217, "uuid": "2daaf1ba-c5b1-4986-8b25-f2c1d1732f78", "comment": "Malware payload (Formbook)", "value": "4c124a979502f2266f7727cdc22bad6d3705232e8a41682c4a21575afae753d42efd040a48b8e5ee75bb6f19da377ea4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372217, "uuid": "28ff745e-3a03-4440-8492-11a59f9b2bc2", "value": "T11F451210BFEA0A05C9468971B79E86718526DED7877F4ED22E1AF40C10743B25ECB63E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372217, "uuid": "c705ef08-feda-493f-8fb0-d427992e9e9c", "value": "24576:VqBuz9pVefQinW3Ve26vsVQVGgOTST1B9bejftPgw:VWuZDefJnW3Ve2Qotgb5ip3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627372217, "uuid": "2c852b28-dda4-4c0d-9bcb-623b82c507c8", "value": 1240576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627372217, "uuid": "e00d990e-d02b-4a63-b45f-76c2e92ae13d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627372217, "uuid": "0d04aa3b-7dd6-44a5-af08-a204024fe937", "value": "status.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8793646-eec0-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1627379786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379786, "uuid": "382c1317-8de7-4b27-846a-753bf0dd8280", "comment": "Malware payload (Gozi)", "value": "d24ee07fdc959b829af8bf5ac24199da", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379786, "uuid": "0b7ec564-e4e3-4377-9744-a806463db1ae", "comment": "Malware payload (Gozi)", "value": "f7dbadb06cb1daf470d3be093f2abc6722ee4fb69d1f9803737eeafd360c75c4", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379786, "uuid": "e8cc4e8c-3921-415b-b7ca-cc5df3abe5c0", "comment": "Malware payload (Gozi)", "value": "dda601c4d2b24b420eecfb2bb4c5d3ec5e1d7bba", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379786, "uuid": "7ef601f2-0994-472f-8cbc-8a3817c9b99e", "comment": "Malware payload (Gozi)", "value": "e398137473df97ad47ace89beffc471be4f7aae348e2234372291856c824fca5db905c6e1f2d74db154e3d963c1db6df", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "pwF7272021", "colour": "#65AD6F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379786, "uuid": "5f7f2a6a-2f57-4bc8-b51b-5fa233515d1f", "value": "T1EE4336D43BD0E907638D1E53FF467AE5E47A686294C8F9078344BE8D24F8217D5A0EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379786, "uuid": "75ee0cdc-d046-48b6-b78b-d80264b635b0", "value": "1536:0qBT2AaN9obqlSne35WBD+tVZ+PzGu//OXKOr59gcZ:0qBT2AUabql+e35y6tVwPzGu//OXKOrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379786, "uuid": "1e7fee3a-fda7-419c-a823-ab41d290ac11", "value": 55309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379786, "uuid": "780efba2-f086-47c7-9f14-198b163d1140", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379786, "uuid": "4ebf4c27-ec80-4f70-8b3e-8ca86549ff52", "value": "form.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb73e5b8-ef35-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627430042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627430042, "uuid": "f72f974d-16fb-42fc-9024-0db498ad870c", "comment": "Malware payload (AgentTesla)", "value": "bbe8f3c73274a97d91e8b9ea33c23f5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627430042, "uuid": "7488b015-4e9b-4c6e-9f03-3857943a27b4", "comment": "Malware payload (AgentTesla)", "value": "f8858f341270ce6e44c3633322716a1f7ec2c691a191218bdfbda60adcc918b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627430042, "uuid": "a612fee4-3ce8-4cb4-b235-bd3aecda3e4e", "comment": "Malware payload (AgentTesla)", "value": "f2a96b4df791397607fda9c32cafa3f9c25ca59d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627430042, "uuid": "f95ae7e2-cc5c-4a8b-9ea6-55c2c584a7af", "comment": "Malware payload (AgentTesla)", "value": "d1d3fc18435a5f2751c6440033d71561338e04a556b199bde2858c75586632c4ceb2e4c2c8c58f73e540dfb8c45c7361", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627430042, "uuid": "532bb32f-ede3-4f2f-baea-c73ba63a471a", "value": "T12CF4CE78655459AFC672A533C268EB00FEF344A27231CD0A538BE6871F0B443699EF6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627430042, "uuid": "289a2ed6-5314-4f17-9b66-166562f3ab0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627430042, "uuid": "913faf95-b0b2-46cd-a1f4-498d796e57fd", "value": "12288:5bXsln+4dXKj90CeqUDrpiEpMzWnLA20K2l0dY/j1uneWfd0zZKWY4Xq3Xrx:9slhcS/9bGzW/0++/Yn3KzZKWfXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627430042, "uuid": "3cf3a4e2-cdcb-4f4b-bef4-6b761b009468", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627430042, "uuid": "29a48324-74d0-486c-a462-52af3ceb5032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627430042, "uuid": "5307beb3-1bbc-4969-b736-0c9f3e2fc375", "value": "Procurement Quotation Request From ALVA TRADERS BY ROYAL Re PR#545 3_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa36331-eee9-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1627397059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397059, "uuid": "48ad3765-085a-4c78-87d5-1fe77f1a1068", "comment": "Malware payload (Loki)", "value": "3cfaf0e919172d1c6e1ef7e766b2fb36", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397059, "uuid": "bb4b4e2f-a70b-40c8-b14b-446174cf4378", "comment": "Malware payload (Loki)", "value": "f8ff829b2fbab28557c00eb6267dabb8918b12644f9daeabd1af0cd7d01c9034", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397059, "uuid": "ab788424-5fe7-4e89-85a0-d9af75e01ca5", "comment": "Malware payload (Loki)", "value": "47f3d29e7daaed6b0b6bdc205e27ff0f971f247c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627397059, "uuid": "88318c24-db43-49c0-8ce1-c07b1586bea5", "comment": "Malware payload (Loki)", "value": "c96fdc2988d8b7e25c20f0513836999676ee18e96c2710f6ecd5001586017550660f6f4c146528cfcd5c23f75907e41e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397059, "uuid": "5ea92d9b-e7fe-43e9-b09a-717ce0c25d80", "value": "T1324522398D6ECF96FC5B09F391146AC415AB9E71DBEC7824123BF160807233B66F9122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397059, "uuid": "acc14de3-d995-4624-9d67-910ff9271db7", "value": "24576:sBXzLET04mrARXinEJObwGy6y1zZChKFP9OcqUZlnDAloki5a5Y5e+:s5BnkRSIX9CcN/qsnQhyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627397059, "uuid": "5d7486de-13c8-4896-9f21-96ade70b23a4", "value": 1210368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627397059, "uuid": "fd186043-2b36-465b-86cf-246ac5661f6d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627397059, "uuid": "50e12044-d5c5-4620-a8c1-b0ea60a44f87", "value": "Arrival Notice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81913918-eef5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627402377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402377, "uuid": "3ee005dc-6ae0-4895-9cbd-84e9ff425aa3", "comment": "Malware payload", "value": "dcf6b8cdb2ee6a680a4a1fa75b316322", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402377, "uuid": "7c098a0a-3f8a-4fca-b2f4-0a734525b3bb", "comment": "Malware payload", "value": "f97cdcc3b6c2cd8510b28131bddb9c843cf8a04a16df4a6b73888805400c431b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402377, "uuid": "517e9f5e-1a29-4d14-9dfc-b480d46adbcf", "comment": "Malware payload", "value": "5aa4a7b29743a2c5cd3bb6d06e8f9f54521d1cd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627402377, "uuid": "25020c76-d380-4b84-ab57-1ce51a7359e4", "comment": "Malware payload", "value": "5aaa342a1254a3074dcb6ad3e4282661553c4dc13aa63a096a4fddf4ff17a113684edd262a1726c3cb9f78f134825c86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402377, "uuid": "938536ad-180e-4c4d-a177-cebe4cac9fc7", "value": "T15E53025350093D216AB51FF6A97630A2D285C95DBBB8C9B6F7A8D29E33C1C0BC03B543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402377, "uuid": "57fc4051-36f3-4659-9926-56dbb918d033", "value": "1536:IFIr7FKmbpzbIYsjqGfplO778Jx7/cZFWzq3:97UmbNbIYeRfTOEJx7/aOq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627402377, "uuid": "79b48c3d-dc0d-40db-b670-bc7150183177", "value": 62520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627402377, "uuid": "90b4f43b-a5b7-46c7-82d2-2c1e8e4d90f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627402377, "uuid": "213b14c2-1889-43bc-8c6a-6daa239d57d1", "value": "dcf6b8cdb2ee6a680a4a1fa75b316322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5fcd8e-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627400784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400784, "uuid": "ca18153d-c85c-4b61-b068-007715ecaa0a", "comment": "Malware payload", "value": "9927a9085ab78cc6da1c68a68fd1d11f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400784, "uuid": "1aa61c38-a307-4e63-b0ba-b1c6ba75135b", "comment": "Malware payload", "value": "faa64bf7a9a7ffe07d17b9b75c4daf8a3b2477aeb9ce04c781962fd6e1457597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400784, "uuid": "e181dcbf-ea98-47b6-99fe-21662dc37700", "comment": "Malware payload", "value": "331da927235937e186345523140a9574a047ed86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400784, "uuid": "5e39a316-f341-4cad-add7-b4a781e2ff0a", "comment": "Malware payload", "value": "cc59601696f40edf4f34cf7912463686a73fad0cce0d638806201a7ec28388ae838d09fce95a2f1258b527de2ae6c768", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400784, "uuid": "5b839753-40e4-424d-a9dd-674e700018fc", "value": "T13915AD0427D88A5BF1FF67B5C0B292A1C3B1B451B93EDB8F5D8424EE1D1A780D9107AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400784, "uuid": "e0948690-efff-4a06-9e90-b53123206a9e", "value": "12288:YFGu3AbJBdBS4msNUCe65frHMnz2R94S4KsfiSe6+fXHxt2Edp:u/wbbdo4mz1U8z2d4KBF/Jt2Edp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400784, "uuid": "684dfcda-3df0-4558-b320-05328fdeccec", "value": 934494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400784, "uuid": "06b3ff76-adf5-42e7-b96e-504e42d6bc03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400784, "uuid": "fe4e72d5-2c86-40eb-a7d6-5ed351e25046", "value": "9927a9085ab78cc6da1c68a68fd1d11f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78d36e2-ee81-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627352646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352646, "uuid": "2992f7ec-46b2-49a0-82ee-0ded5058aed6", "comment": "Malware payload (Mirai)", "value": "f6ccf683574cafb453a6e5a5b46c9a8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352646, "uuid": "72af8264-4535-4825-8132-0f88c2ef3514", "comment": "Malware payload (Mirai)", "value": "fac700b7eccc17b83061cfe1b9aa880fecd6e8203e6d1fb2edc904fc506eb193", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352646, "uuid": "5b0a1a03-1cb3-4eff-8a69-4f6e35803351", "comment": "Malware payload (Mirai)", "value": "5c2336d497f1511bf77f2270d952876ec5a2b626", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627352646, "uuid": "7524b642-6df2-452a-aa98-53e8a9ba5058", "comment": "Malware payload (Mirai)", "value": "aade48530ba853ab3d9d4fd1f01a1a0f0334b7055f3f39e3d54d508b7132a4f8a0b94200fefec6462a2d8a927986ade8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352646, "uuid": "0dacb668-bfd3-4fcb-b113-299ab1bdd3d5", "value": "T15633F11B897ED5A684D0D833F45A02C8730A47FDEAAF74A1334806202B59BBE355BD9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352646, "uuid": "bd183ad6-c31e-417a-8871-26220bd07742", "value": "1536:Bs90PjD4dIuPFdwQg/0K2oQLb114p7snKIK2:Bs9GD4dIuPFdwQzQQLb1yp7snzK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627352646, "uuid": "3af7a7e1-344e-497c-bb82-66d289c91a2c", "value": 53628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627352646, "uuid": "8f208b7e-2211-4270-9791-1c9b26e6ac55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627352646, "uuid": "35d07be0-d0a1-46cf-8945-0121147aab2e", "value": "f6ccf683574cafb453a6e5a5b46c9a8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2954fd3-ef02-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627408016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408016, "uuid": "c4c2282a-365d-443b-8712-f7d8cc82710b", "comment": "Malware payload", "value": "b8e5a84cef79a45bb1d32eae8cfefb0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408016, "uuid": "36940e6c-35bd-4781-8b3f-83065902eaaf", "comment": "Malware payload", "value": "fad8c5931f0dd3fbd63fe0a0e2d6799edf4004ed20a9afebbcd54cfabb5595fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408016, "uuid": "2314b074-8127-4ba2-bc00-2f027b306e1d", "comment": "Malware payload", "value": "4f54310299013d1fd52c0f8e1640487393a5ee9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627408016, "uuid": "91e78862-9e1d-4662-8e14-b58d9cec874f", "comment": "Malware payload", "value": "9fe3419a2aaca1392c3b57e66263ff27637b47c37f94d3057b47670cdd6e239ca67ac1675b8e8e65038e4980e79c6061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408016, "uuid": "4fae7da6-3dbf-438c-a2b0-b37d74ce8a97", "value": "T158159D19B700BBAAD27D1E75C95B0D1893F0895B73B2FA9B28E139D00531B9D8A1F1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408016, "uuid": "71ef02d3-a705-4237-b81a-a9fd93ae0144", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408016, "uuid": "23862cb4-609e-4008-be4f-eebdd3c62ec0", "value": "12288:shB+wyTIuPgXcvNaOgKJfctA2/RQDiVISCmCBeJ5eQU7:DTI3cV2LfRyiaSC3Bi5eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627408016, "uuid": "2ddafd09-b4f6-459d-8cd7-82ef16bd30e8", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627408016, "uuid": "ed54ebdd-dbf3-4d63-8b29-9b45975e3db6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627408016, "uuid": "32fda29c-cc0a-486e-801a-7fda84f27210", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551f193e-ee9f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1627365366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365366, "uuid": "dff875c4-2935-4868-a912-ea353a34c4c5", "comment": "Malware payload (SnakeKeylogger)", "value": "5898734f512fe21e26447c8b28fe802f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365366, "uuid": "757cb3f0-7c58-4d65-ae3b-665bfa278905", "comment": "Malware payload (SnakeKeylogger)", "value": "fb04731280999bb99a45d6473b6fd1d8a9cad45654ee21d7a5ca89b8a6a7e41e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365366, "uuid": "8d630226-d92d-421e-ae8f-6c7c54cbbaea", "comment": "Malware payload (SnakeKeylogger)", "value": "eefb6ef334e0ae3fe1316256831a087d412f6008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365366, "uuid": "78083ae9-27a7-491c-8f66-e16d5c82b1e3", "comment": "Malware payload (SnakeKeylogger)", "value": "7022bf1a1e6408e9464d637de07f06f6b50b86d778a8c49dd022804eab006b8a04b189161eac5794c9ac003d7c7de801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365366, "uuid": "ecc51694-c095-4264-b8e3-2e33a43f0935", "value": "T1B0E2C6596151B125DAEB4A702C22ED743A3C97B45840D20EF4A6958CCF82AFB74ECCDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365366, "uuid": "6ed38793-9bb4-47d2-b44d-1c6173fd10fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365366, "uuid": "7bb4394a-1fbb-4bf3-970b-62e1e31ba60c", "value": "384:qnuynDLcxJC2FdMPZGvJXt9iNSUxRZ73Z3OUta68e2PWZx3VDnGnhJ:182CCKBGvJXt9i8Uxj93O5K9chJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365366, "uuid": "54cad933-e7be-4400-b1e3-eac51dc4e7f2", "value": 32552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365366, "uuid": "779dd3d1-f6b8-4429-b3da-5d664f5ae0bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365366, "uuid": "6e566901-e19d-49ed-bca5-0f480e1501a7", "value": "invoice.02 Nazih El Chouli.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52aec1ac-eec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627382112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382112, "uuid": "cfb8d0d4-4a71-42fd-8ca2-b33d9fe787c2", "comment": "Malware payload (Mirai)", "value": "53445cc57c88f85070bc95805df5290b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382112, "uuid": "d28bb3d3-ca61-4e3b-a354-22ecebd726c0", "comment": "Malware payload (Mirai)", "value": "fb5632f4684874fce0b0a7b5f1d642d3eacefcef8beee372db5a0e3fcf619c4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382112, "uuid": "2488a6b7-19a2-4bb3-8558-ce685d7a09e4", "comment": "Malware payload (Mirai)", "value": "a9dedfa678515d9c58afc843bcd4a1591d0f05f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627382112, "uuid": "992e2abf-49cb-4863-9a98-d92fa41c8cde", "comment": "Malware payload (Mirai)", "value": "0cf6b3c4c3601c23d69dec5db2e1ad5c9f6bb981e6e06a9d722f28084571fc29b280e9b5224b783c0f29dd9e58177eee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382112, "uuid": "07525a54-d8de-4d31-a894-3a3e0faf0a38", "value": "T14743F756B8918F02C5D816BAFA1E118D3327677CE2DFB3229D105F24778B92B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382112, "uuid": "e3172645-9fd5-4ecc-ac93-e5d2e7db768f", "value": "1536:mVnvsua8vd0wWx0/GMHdoAnsLzIXiWEkqIWDT:xuai0mOSPEkqIWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627382112, "uuid": "c565a86d-648d-49e6-944a-a09dc2135b7c", "value": 56116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627382112, "uuid": "6fd433a1-a2ba-4d36-a6ef-d9ca806f148d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627382112, "uuid": "3eb6ebac-631b-4a32-8af9-bfe6f7e0606f", "value": "53445cc57c88f85070bc95805df5290b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284de560-eee8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627396644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396644, "uuid": "2caa0b23-0ba7-4c99-ba22-24f1eb1dde38", "comment": "Malware payload", "value": "330c6c2b0ca5bdc31ec28cd629145eaa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396644, "uuid": "4195dc01-5ff1-44df-8c58-1a06f9815a0e", "comment": "Malware payload", "value": "fb73c93c978351fd70a26b1ddf59214a191e32d1c36bfd0183d7674987572e68", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396644, "uuid": "ea4dd74b-a785-4ac1-93b4-8c49eb343f31", "comment": "Malware payload", "value": "c8f3660896f6e98be48cf87ca6a2108a9d685d50", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396644, "uuid": "78dc09e9-729b-4319-8141-b72ce14c8ec4", "comment": "Malware payload", "value": "d2a3079f2774942c9f8bed9620fc2c1adaabbeb33018904c9310237660ef451614eba209dc4872ab1bb398f5f455b231", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396644, "uuid": "057f7b47-b69d-4950-ae84-f62d0d589512", "value": "T1367567F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396644, "uuid": "d7c86880-1e66-4742-bdc8-6961af15183a", "value": "12288:aqBa/BtfOLaZQWrS+H8UErBQLeugD72F5XIAQwP3mq:aqSfOLTmwrOgD45XIAQwPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396644, "uuid": "9ce20031-860b-4225-a4b0-fdff1e4cd628", "value": 1682037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396644, "uuid": "bd358f38-8d74-44f2-86a6-25b22b015f19", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396644, "uuid": "2c52b770-82bb-43df-ac41-beb439b5a6e4", "value": "ORDER-PO#-ASLF1SR00121.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d68d7f5-eeab-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1627370614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627370614, "uuid": "7a34f0c4-d065-424e-aaa7-5fdd4d39f32f", "comment": "Malware payload (Dridex)", "value": "58bf730c02fb67e6de279877eb281925", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627370614, "uuid": "0921c814-36e4-4e82-be83-c5faec56dc7c", "comment": "Malware payload (Dridex)", "value": "fbd108648a43add9a2e400640f3e60a7f31971d748ad0e3f8531a17fa328e7c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627370614, "uuid": "491b2c18-a6ae-4bff-ba90-e304601b0810", "comment": "Malware payload (Dridex)", "value": "db2380c9d4e6ff9cd7dae6394f315753604adf6b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627370614, "uuid": "7ad21959-0b2e-4a31-8796-c4ce5375e9ea", "comment": "Malware payload (Dridex)", "value": "02338a97b7b20cc73404cd1cff0afd83c253a1c190d96f9b7f9f167730cff7cde626e848cbe5c5b09eb548e4cfe35720", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627370614, "uuid": "0cdeee65-bcac-45e5-a589-8a2928957b1b", "value": "T14304CF51D2DF2AD9C41E87BC11947A0976707EC2CB68C078E26AC4BCEF7BD4649E4326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627370614, "uuid": "5299ad0a-6543-4000-aa7b-1d7e35e875d5", "value": "038ee71bd4ea63acaf586d3475ef17a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627370614, "uuid": "35423c2e-aa46-4fc9-b52d-16fc7f242543", "value": "3072:RGY5bY8XE+kkqh84cKcv4FinaLzL2rVQLOmpvNbTAvJstOr18T:sRAkkk84e4wne2nmhFAvJ4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627370614, "uuid": "dd2e311c-dbcc-40c7-9775-158633158266", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627370614, "uuid": "f7935a9a-a203-46ae-bef2-25d41e88e5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627370614, "uuid": "fddc936e-fe1c-4ade-a2ab-e5df83177611", "value": "hsy_utu8_12u_v4.4.7.0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd13068-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627400545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400545, "uuid": "a3009da6-987d-4630-8244-63ae960cfcfa", "comment": "Malware payload (Formbook)", "value": "6e77fe0eb26c4834a5411e66a78a3e69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400545, "uuid": "8a721ebf-2f73-4733-a16b-63597bf03359", "comment": "Malware payload (Formbook)", "value": "fbeb9b62ff737a87fe38709d075f3fee34502b01262480cf5a014efaab4f7075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400545, "uuid": "16e4c322-9131-4c66-88a0-8acfc2e765a2", "comment": "Malware payload (Formbook)", "value": "5c9768be8ed60c6190e68deeebc5f3c1cdbf531a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400545, "uuid": "aca8db89-1123-47b4-8873-9d9888426321", "comment": "Malware payload (Formbook)", "value": "1f9a668275b5d4b7aedb77774c84cfb69458c2eca32f17199eda796b1849663cb98eb761f4420f0b39937cf270e653fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400545, "uuid": "8d981685-996a-4905-8bda-fc00905353f9", "value": "T14E15F1263227A218DC3887F51C69C1B02BFA9C29566CC67D2EC4AD7F7DB367C5AD0640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400545, "uuid": "93b6743a-0e2e-4d19-8c14-e8a01b3d6502", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400545, "uuid": "beb94949-e7d5-45ae-b0db-5430a26784ab", "value": "24576:8vDBlBPIOBPR4aF9jqQ3Rl6GsCA/29Aqo+OMB:EpPDPlF92qbKPOuDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400545, "uuid": "024d8495-cca2-4ab7-8fc3-53c29311a499", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400545, "uuid": "14bc9cab-6961-4329-8ddb-2e6c76a39403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400545, "uuid": "fd744da2-4a1c-4a4c-a344-39ea7d26b68f", "value": "0ictba3ik3lrJnW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6df1bc3-eee7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627396507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396507, "uuid": "74e9d204-fcec-46cf-8010-c8de36f6a889", "comment": "Malware payload (Mirai)", "value": "8467e32b351dee8822fbed523a6788b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396507, "uuid": "153f408e-9be1-437e-89a0-2d577e9b805a", "comment": "Malware payload (Mirai)", "value": "fc0e608f95d0b1747fcb91ce39b47b7a5757453281ec782d4a3c207f4c3828fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396507, "uuid": "3cacb1bc-bd0e-4457-9606-b38d94125054", "comment": "Malware payload (Mirai)", "value": "5e3bdb21b352bec523ef54443cb3e28bd805e794", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627396507, "uuid": "1d9c0af2-3377-4676-84fd-e04afb744fcd", "comment": "Malware payload (Mirai)", "value": "2661990005ae767b1174b8d354e867f6480d6758f62bcb15d84fbdd25bf6ab8ae94bd1854091c90fdd106eb8bbe46734", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396507, "uuid": "6df5ac33-463a-44eb-8cb1-3f7d2bdaecfe", "value": "T12E43A5493E219FADFBAC873547B78E30938833D236E1D685E19CDA015E7024D646FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396507, "uuid": "67106dd2-cbcf-4788-8426-6f8de38dde84", "value": "1536:Gf7FiuZVYq50AXKvd9Q7Gw8zGfKeZznjK:zu/Yq5yoGjGfKe9njK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627396507, "uuid": "0db504ba-8f34-4fc9-b163-541f09b92c30", "value": 55172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627396507, "uuid": "496a73c0-5b0a-4b5c-8719-1d9a1253f7ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627396507, "uuid": "f857bcbd-d3b1-4259-bd2c-9878dea91f4b", "value": "8467e32b351dee8822fbed523a6788b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e08ec54-eedb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627391177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391177, "uuid": "718991d7-a4f4-47ab-9188-c7af15a24ef1", "comment": "Malware payload (AgentTesla)", "value": "197e571bfcf3f22816e245fef4f86b4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391177, "uuid": "766a8856-0e50-46d1-b427-6088068aae7c", "comment": "Malware payload (AgentTesla)", "value": "fc22aaa35e5504461dd5ace02d041f7715bc25acf329d2070e02e854b54d4de0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391177, "uuid": "ed15ce12-c6cf-44e5-9b7c-01c4d9b474bf", "comment": "Malware payload (AgentTesla)", "value": "60df9b31aeb301c4c480da58f75be14d775cb604", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627391177, "uuid": "3d2359ba-e0d5-4466-a395-4e545cfa3023", "comment": "Malware payload (AgentTesla)", "value": "d4f1de21fc061cbd0d4c654359b48e332804c920405b5e3c5824cf68694a408d26920a0416e3f1a685ff0e28935fc09e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391177, "uuid": "21667ec8-f160-4e1d-9b40-e6f3f8d5f6d3", "value": "T154255A3439FA502AF173EFB58BE4759ADA6FBB733707A419109103864623A81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391177, "uuid": "f5e54e6b-c11f-49d3-b264-67ba08c22e54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391177, "uuid": "c90490fd-b39f-4994-aa14-14a0a64477a1", "value": "12288:/FhKzgGe0kY8WBvYXEK4EOBjMUEDF+dOKBFYFW6Znb5dnQJDJCcMujLMIy7uqc9l:/FhPGMW/LSFOITZQJlVyKvK1U2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627391177, "uuid": "c57e4976-95ed-4b3f-94d4-8a6221347f9d", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627391177, "uuid": "3aa00915-4785-4f14-aefb-9ab025620a3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627391177, "uuid": "85d8c96e-09cf-4bcd-b577-9f3b4829a44c", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83691c2e-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1627400232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400232, "uuid": "e0713a4f-4032-4fff-b96a-560c00968edf", "comment": "Malware payload (RedLineStealer)", "value": "111f54264510164719eeb43b56d385d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400232, "uuid": "63959501-cbdf-4831-b331-b78340c240f7", "comment": "Malware payload (RedLineStealer)", "value": "fc4cc2a7d217e04b0b3406cf3b62b7f16dcee104cf5a05497092d2d93d858509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400232, "uuid": "3bdd21e8-52e8-4805-b259-858f47d3b24e", "comment": "Malware payload (RedLineStealer)", "value": "47f300489c9198cfdaf5dbc6fea4050610566f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400232, "uuid": "ccafdd1b-7af8-4cb1-a212-002c2fb64526", "comment": "Malware payload (RedLineStealer)", "value": "06e854020c85d3eeff418937122cc64963e92b5babe788f35555166ecdc3caa45564a21e95aeb6a83f1015752045327b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400232, "uuid": "9e330db4-fb86-4aa2-9f7f-9cb980c29988", "value": "T134E4E020B7A1C438F1F221F8157693BDA93A7EB1A72451CB62D52BEE42346E5EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400232, "uuid": "ea65746a-1915-4167-a721-9d1d917378fe", "value": "cd8b6907b5cf87baf066346ab3baafdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400232, "uuid": "62624f55-b5e8-4ca7-8805-14529e5169ec", "value": "12288:TH1sUnbqv0GZ75y2g2yNsK990C+KHzf/wUykoqDFMgmi1gropbxrNSQNhJY:TGU2v0U7WsK9yC+KHboUykDDF8iu6bxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400232, "uuid": "d83ef6e6-8e35-447c-b6f1-0dadd749e5da", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400232, "uuid": "2c5539f6-c2e0-4297-979a-34d1ce82399c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400232, "uuid": "d72de235-15c9-4b1b-a582-7294988a9636", "value": "111f54264510164719eeb43b56d385d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d785157-eef0-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1627400249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400249, "uuid": "5b4c6f0c-984c-4460-9a01-a606057178ee", "comment": "Malware payload (ArkeiStealer)", "value": "16392aff3e3d431b88c986092e59ee3e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400249, "uuid": "34e0be2f-0d56-48ef-b206-7f61ea7126d3", "comment": "Malware payload (ArkeiStealer)", "value": "fd1ccacb667af6c1bb28bbfa7da1729407f873d3e69c28d8cc933af562e95624", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400249, "uuid": "41a0f269-077c-4d4b-9916-c189bc1ae536", "comment": "Malware payload (ArkeiStealer)", "value": "d6bc54ace7185f1dd448d4e51ab13f1cd7172711", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400249, "uuid": "2570d59b-fd73-42cc-b733-a45217df2593", "comment": "Malware payload (ArkeiStealer)", "value": "68434ba568f5f79c7ac6d136a574487184cf6a25dcf566ae82f8df6a5d4c0aa44142c8e6ca43720f44dae1514be7146a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400249, "uuid": "d5fa52aa-c088-4e16-b9f1-01b18fda66d9", "value": "T155C4018673C8692DC96897F4710243764A709F637D1BD29724B83DBD7E8B3C2282F256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400249, "uuid": "b5d38708-e39f-445d-aff7-ce0741221353", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400249, "uuid": "e421daef-5e97-4d8a-a1cc-704fd5c71458", "value": "12288:e8CUnvo7BFlIe7Sy8vuu2zfFd5A2K43p1+3WoyLQ:e8DQHlPm9vn2zfv5z1WWoyLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400249, "uuid": "afce3f86-4505-496b-b264-9ae47a64dbfa", "value": 550024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400249, "uuid": "19677011-396e-4d2e-8360-7809ceea96eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400249, "uuid": "cb0b9e20-77d5-4fe3-b7c0-62d01bff8589", "value": "16392aff3e3d431b88c986092e59ee3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007f51b1-eea7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627368660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368660, "uuid": "96bc1719-00e8-4db1-b7bc-429cdb81603e", "comment": "Malware payload", "value": "dd5a8a79e783a6ec289ee0cd8d4cfe5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368660, "uuid": "090e6305-79e8-47ac-985b-bdd099dd0568", "comment": "Malware payload", "value": "fd41a1475cc38cea40bfed26e3ba1a65dd3a2ded1a66911e00f1bac4b1715746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368660, "uuid": "2a872f96-41a1-4919-8e7b-ea3b3a029732", "comment": "Malware payload", "value": "0532d6f61d5bae479b03fed7fccaf82c455c9e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627368660, "uuid": "e7cab0cb-a7f1-482d-ab41-089c746895fa", "comment": "Malware payload", "value": "d3d1112da38177ff1829e8f5a6ce96600dad8581b6da8650f1a4b587440851dc7bfc0a2f7d08a04e41b71e4bf4f87baf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368660, "uuid": "10d532f9-8ec8-4cdc-a091-6870a2fbaf6a", "value": "T197D63311AD1BD8A1F92506740865CDFFA8C3AC399262DD81DCB4BBE639317FB844853E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368660, "uuid": "792452f5-1c7c-442e-9da1-eded0d5c279c", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368660, "uuid": "ade803af-d1de-459d-bb1d-5aa41ca43d54", "value": "393216:+4st6YjDkz/VJeVjAx5EJu1hfaZyZSUok:oEYjDkz/reaKkKysU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627368660, "uuid": "553a3f4f-74bb-41cf-b83f-bae9aa6b56c1", "value": 13099224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627368660, "uuid": "0d4ff7fc-a059-4a36-a2f4-dd7b3b12c4d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627368660, "uuid": "5d9ab900-6d3b-43bc-868b-6f11b070dbcd", "value": "SecuriteInfo.com.Trojan.BPlug.3926.32378.6533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd973ae-eea1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1627366216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366216, "uuid": "99616948-a134-4f56-8064-4f5deb41a4fc", "comment": "Malware payload (AgentTesla)", "value": "d4ac2e301d054744db922f396d497a1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366216, "uuid": "859122d6-ee5f-48cd-b48b-2056285794b7", "comment": "Malware payload (AgentTesla)", "value": "fdaff5b7230a045f22dcafc4da592c42c3386770c58757cc825a99fcef5f1f78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366216, "uuid": "4d33713f-0887-42e2-886b-5c0b2ac0181b", "comment": "Malware payload (AgentTesla)", "value": "0a580a7ca5e1e2128ab507e644df45c54d939192", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627366216, "uuid": "267e081a-9ac0-4c51-834c-d86037b7c636", "comment": "Malware payload (AgentTesla)", "value": "07eaea4a32a76fff29bd68645292c930db9d1f0f69fc5a01ba5912902b2517d8a7c188e0bdb2ac13b248525c7f39b72a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366216, "uuid": "537e51f3-1c84-43f3-88b7-a6ba37593e55", "value": "T168D4DFF5193E770BF49309FE20B191A329A484E9CCA9CBE4F73351ABEF254576081786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366216, "uuid": "a87c0f5e-6188-465e-ac5b-3466210b36d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366216, "uuid": "484f801c-b1b6-4951-b682-16c49e7bfd7a", "value": "12288:wOsBgo0q4wMUsutJ0PNXVGYC+0quXXkzItj+DFZWWwobEnNeUJ:wOsBgo0q4wMEJQXd6qYXkkcJZzwHNe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627366216, "uuid": "233651d7-c1e0-4c36-a461-2799cb788178", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627366216, "uuid": "63c9c919-9879-45dd-bfda-93d95025eb99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627366216, "uuid": "03b42d96-0778-4e6e-b7fb-1590efdcb0ca", "value": "Purchase Oder List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1534281b-eef1-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1627400477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400477, "uuid": "c8834c47-f5b5-4aa2-987b-765beae9d415", "comment": "Malware payload (ArkeiStealer)", "value": "12669aaffc7529caec004ae9b351e592", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400477, "uuid": "97b8154f-0958-4bce-ba12-8c434469e7c0", "comment": "Malware payload (ArkeiStealer)", "value": "fe05b66d6140aec7855bb58fcf186c8529c3a7630d0985f5201b31f92d9d63fe", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400477, "uuid": "126cb33e-2838-4176-bc27-e46862bb7b5f", "comment": "Malware payload (ArkeiStealer)", "value": "31705c2612209846bd09e1c98f57f9d0badff58a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627400477, "uuid": "4b488477-c690-436b-af29-7b005a1e1dd0", "comment": "Malware payload (ArkeiStealer)", "value": "35282b21a521fdef70200f6cc60c4e884c11d3a43160ebeb1903ea68627e0b6753b952ad28bff5774f607b08dc66d202", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400477, "uuid": "bfaf5cbb-a0ae-4970-a53b-0c67b782e66c", "value": "T12AB4F19B3BA4228CD0B8C57844430A619E321D73BD5251869F71B52E1CBB3E9F91F8DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400477, "uuid": "d955fb26-0de9-4e03-9bfc-335c6d1e2ca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400477, "uuid": "e600add8-cc4e-421d-aa74-2bc13ef57354", "value": "12288:ldgzNv4IG3MQLQ+RSKua8PB3JsdAZvfGA2NWRTL3zK+fY:ldgSIV0Q+vbSsdAZHONWxnvfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627400477, "uuid": "efecec1f-ccae-42c4-8370-4b281aa68ea0", "value": 533720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627400477, "uuid": "749f1bf9-55c6-4b48-a4f6-66a3f10422dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627400477, "uuid": "6a19508f-68e0-46df-a531-2d17efdb9c6a", "value": "12669aaffc7529caec004ae9b351e592.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cd2e88-ef10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1627414063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414063, "uuid": "a33733b0-729c-4470-8397-ea0cfb5cf279", "comment": "Malware payload", "value": "2a5da32c99bf506f68842b9904a4a12f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414063, "uuid": "8fe5a206-5563-43c1-80aa-cea1b03f33f4", "comment": "Malware payload", "value": "fe9b8e71aee05732e1676b811765fa9267aa81f513d11f7e204f67a8b1f710f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414063, "uuid": "94c36062-e766-439e-8044-4af6131b93e5", "comment": "Malware payload", "value": "55b8515bcbad6109ef2caef9fe38664a47362fc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627414063, "uuid": "683ccd2f-0005-4973-ac1c-40cfc5f24a36", "comment": "Malware payload", "value": "c5833b1ea6acf4fc0f29e5aac33d2d28b3b75d0e6a326aabc1e22778fca8cab88406bd69fa18ee9a80823acf299ea71c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414063, "uuid": "84696665-79cb-4096-af92-30ef2ac6f52d", "value": "T13C534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E374999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414063, "uuid": "00c96774-fc55-45b1-a504-a2204cef0db2", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Bv6GG4TlW2c5sjgi+DDiZ/v0BbsVf:2KbpuqJlzk5xGpJgbDOZ/v0uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627414063, "uuid": "a8a42e0d-f82e-48ed-9163-18e9f2908ad0", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627414063, "uuid": "bc6c3308-fbca-4342-8ac7-cc7ae8b03ab6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627414063, "uuid": "ced8ce45-51e2-4f7e-adb9-4d5b1399e1bd", "value": "2a5da32c99bf506f68842b9904a4a12f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa1d38d-ee9e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1627365195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365195, "uuid": "847c0650-19cb-4b75-b2b7-19563aa2c406", "comment": "Malware payload (Formbook)", "value": "73ed1d0763d00046dbb66b5d067711bf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365195, "uuid": "ecc1352d-173a-4ae0-ae0b-8c6c2b96963d", "comment": "Malware payload (Formbook)", "value": "feb73c77207bfbced59a52ff4f43ad03b712c53cbdffe479c6c4d9d56e1ed267", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365195, "uuid": "402e969b-7633-4734-9941-b2df3a267739", "comment": "Malware payload (Formbook)", "value": "eeb45adb3093b73a967b0ef75c226c81988c2765", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627365195, "uuid": "957b1d01-edfc-4904-9e58-7471bae61f77", "comment": "Malware payload (Formbook)", "value": "874912a528c78dab97da65c8fee0a76f9d46f00fb74a7687d860842805e5d70d312c0eb835933d0aef53ef490af2a136", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365195, "uuid": "1d0f6dc6-5e20-447a-b023-0ca51f4e31eb", "value": "T123942318586C0E9748DA2A7F2DE0FCB96F3DBDB5874BA4844E14E81D097F07ADE14398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365195, "uuid": "b1cb2db1-d299-4ba9-aa4a-207f3af0cff6", "value": "12288:eVo6kqZtYjBG5VrSAPYjIuwODCPaQ6OHo3+A:+6QtYY5UWYjIuwO4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627365195, "uuid": "c05bafdd-a5b9-4a4c-842c-89b345a9b4cc", "value": 441580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627365195, "uuid": "67f875ba-7d7e-41d7-8ee4-9e1459e40f20", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627365195, "uuid": "edc52906-bb65-46f1-8251-95c657641cb4", "value": "New Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c38248-eebf-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1627379022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379022, "uuid": "fd53f5f2-4bcc-4f02-93e0-9e8110a28059", "comment": "Malware payload (Mirai)", "value": "fb7a087ccc2aee88105b38cb1eac82ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379022, "uuid": "704dc942-1845-4849-93dd-aacfadbf6fd3", "comment": "Malware payload (Mirai)", "value": "fee0ae178999a65f97c601bb0694dd9205690f1feb93f0ff84f4388ede519add", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379022, "uuid": "4c3c7f28-3c28-4607-be8c-1f8b7d6d71ab", "comment": "Malware payload (Mirai)", "value": "1fbdfb04cbd5b5693a5d6578e9381d89c5d44040", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1627379022, "uuid": "d30a6281-65fa-4167-aa66-df924b5ad064", "comment": "Malware payload (Mirai)", "value": "c957626d1bffc10b64518e2658f7b5d1020ee325518debbfc1f58fd89613fbb20fed595decc36ad23c3d9f89f9d724fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379022, "uuid": "71e20396-b14d-4ee9-83ee-8b932f7ff47e", "value": "T1B32329ABB800EE7CF86AF6BE8117050DB621329044A30B276777FD839D73194AD1DE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379022, "uuid": "4dd62947-708e-4d6c-9118-25f757208635", "value": "768:tkegBXaUZRl2kWFbsMn6zbzpCjX7qoIzpSK28T9fCxJ8EcE:6fXao7A76rpCzWoqSK28RfC/87E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1627379022, "uuid": "eb4b492c-07ab-4dab-b8f0-1d4e7f41a850", "value": 47012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1627379022, "uuid": "5817dfdb-bd12-486b-b064-66119bf08238", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1627379022, "uuid": "bd5172d6-36c5-4b06-b066-b1ebcbed0cf5", "value": "fb7a087ccc2aee88105b38cb1eac82ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }