{ "Event": { "published": true, "date": "2021-06-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-14", "timestamp": 1623715381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5633a2a5-891c-4639-b4ac-fa4a247a8e54", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fc9607-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629232, "uuid": "e84e5753-10bb-4df0-a07c-219e1cfc19f4", "comment": "Malware payload (Gelsemium)", "value": "bc4d2f84a6ce49f06a6be32ccfaa1630", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629232, "uuid": "a14556f6-ec0e-4061-a32d-30962f055c0a", "comment": "Malware payload (Gelsemium)", "value": "00b701e3ef29912c1fcd8c2154c4ae372cfe542cfa54ffcce9fb449883097cec", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629232, "uuid": "25882f97-f8c8-45c8-8e33-2f872c1e881c", "comment": "Malware payload (Gelsemium)", "value": "6f43fe80806a3fe5c866c0b63cc5b105a85d0e75", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629232, "uuid": "c4b13021-28cd-4103-a254-55ac9533ff34", "comment": "Malware payload (Gelsemium)", "value": "56a45358808bec22d859b5f24f6aa688d3cb255153b07b138f9342ece7a28c96808ae364c95a1e8f30d156ba52ce528d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629232, "uuid": "dd6b61f5-2df0-4b41-ae68-98c92ec16259", "value": "59A41207D3E40182E979527C19BB577B8F3ABC9A4C9093979298FC6D6C72601E4293CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629232, "uuid": "b97fca45-465e-485a-abac-11c799de55cd", "value": "836e0c9b4a8110c512055b98bcd30141", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629232, "uuid": "a5c464cc-48fa-4a5c-8092-9b5e13724500", "value": "12288:ECVrN8KTdfZgMvDoWQDUEOHcKReREQbN3x2aVD+p:EkNPTdfZfJVHcKPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629232, "uuid": "c500cb7a-472a-4ae2-be65-93c472965bf6", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629232, "uuid": "72ef418b-f759-411c-a629-62dab5ebaf9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629232, "uuid": "e94328a6-87b6-4dda-b460-925879787dad", "value": "00b701e3ef29912c1fcd8c2154c4ae372cfe542cfa54ffcce9fb449883097cec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62e56fa-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623652100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652100, "uuid": "7311fa30-019d-49b9-93b2-c9b3af4fd01f", "comment": "Malware payload (Gafgyt)", "value": "b096afefcd6db937329f70ef311c9756", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652100, "uuid": "f6457035-4511-4db0-a3e3-24c1882b0e87", "comment": "Malware payload (Gafgyt)", "value": "010afca8313d15e2ab2ae18167ada9dd0f35f1c2bc7372ff235e496f314e0c8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652100, "uuid": "25b49132-c69b-4154-b179-f3b0e786fc8d", "comment": "Malware payload (Gafgyt)", "value": "f9beafbbfa208b1c9b2f90546132d2ea6690b6ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652100, "uuid": "6ecb9c6a-cf00-4707-81fe-d474eda58d74", "comment": "Malware payload (Gafgyt)", "value": "c9ea9dea04135bcf46d1f388febf9c562f198e81d09c18a21893a1c3a6ae4085b07a3c2bb744dfdfe2111dbc5004976c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652100, "uuid": "1bbbb79c-f3b8-4614-a2bf-e948538f86ce", "value": "9AC31A05FD404B27C7E227BAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652100, "uuid": "f73987c9-3b5d-41c8-b0c6-3bc687df2d17", "value": "3072:SJDZ+6lJQTnoo3DKOzmGfcX5O5hLuhu+6+1AzfqojwQQRh6RYAvZR:RmGa5O5hLuhucojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652100, "uuid": "0bf7fa20-c857-49fe-99fa-73b66a177732", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652100, "uuid": "340a03c2-cb63-49b1-93cb-688d5a4c858e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652100, "uuid": "5b9f7e07-ded0-4f83-8f96-2f58d155e647", "value": "b096afefcd6db937329f70ef311c9756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2765306-cd24-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623684279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684279, "uuid": "ef556375-d4d8-4728-9f54-5b3487cdac92", "comment": "Malware payload (Quakbot)", "value": "c8a6fddaae6139af6ebaae08e9f1d59b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684279, "uuid": "8978c779-7f9e-4eaa-8686-40f0d2402301", "comment": "Malware payload (Quakbot)", "value": "0187c57094a61d34fd6d7fb93fe6d826e5d7f0490378c664c41c30deb3f761bf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684279, "uuid": "61364667-2873-40ed-8a80-57ff8ae14f77", "comment": "Malware payload (Quakbot)", "value": "197519904b6f1fcb63d86d8746cefee499c0a811", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684279, "uuid": "74986c0a-b7f2-49de-8230-805f7ef9ea40", "comment": "Malware payload (Quakbot)", "value": "e215d864fcec3bcdc352edf4d8c6440dafa7ed294fe66f09438a2f8bd1e40f10e944ac441086f612053290a4e1d2acae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684279, "uuid": "0ff5903c-afa9-4875-81fd-8fde017fc2a5", "value": "A635BE41B585F836C12519395F84F6E50B6CBC244F69268F37C91FAF6B3D2830A2936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684279, "uuid": "33a0554c-13de-4d46-a57a-cc66090d62f5", "value": "6e1334af14515d2fae56a542c908133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684279, "uuid": "c8d54962-6ecc-42ab-8ec8-e39802f0e5d7", "value": "24576:mDc3ZBXFdNMf6ndhFe3KYNdcyI5i7m0EEOy4TFqE:mkdKf6ndhQRzI5iAEOBFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623684279, "uuid": "e44da0c7-c88b-435a-b332-e549c90b38c0", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623684279, "uuid": "93b72e2c-5ca6-49fb-8e9e-d6a6567246f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684279, "uuid": "2ee2a9b1-d175-49bb-ba7c-d96559ddde36", "value": "c8a6fddaae6139af6ebaae08e9f1d59b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69195f79-cccf-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623647675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647675, "uuid": "9316e4a1-ce85-4bbe-9442-0e9e1204dd2f", "comment": "Malware payload (SnakeKeylogger)", "value": "10b260a8523ac9c3ec698acb1ca5f50a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647675, "uuid": "74c91d35-d1f9-4e2e-9318-3543f5816bb4", "comment": "Malware payload (SnakeKeylogger)", "value": "01911794d3f2b32f3e5311c7367e985160151545d29fb2f9514a7c0a41db6d58", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647675, "uuid": "ac3527d7-44bf-43a9-b25c-622d2c475701", "comment": "Malware payload (SnakeKeylogger)", "value": "4ff9d91bca229630e6738fc40fe36223f1be6837", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647675, "uuid": "72893d96-48b5-4686-9ba0-62d347ab2e75", "comment": "Malware payload (SnakeKeylogger)", "value": "2f8f3e6df42f57965243e2d6f7468a41192140a9c561956fc56d8d8a3befdd0dce99288aaa56bade6bddaa8c02fc181d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647675, "uuid": "1511bfe8-718a-4f3d-836f-23f6cd935228", "value": "24E423D8005AB8C9BBAA48CF5DD599E1C95758B1EBFE23B6DDC60804A0CF3A44C1EC49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647675, "uuid": "c2fe6788-eea4-4cbf-ae84-04e7ec9af716", "value": "12288:zZYWtpfp1Ce/W7nwR/ebKiv715kyth5jHxregZfKAuxXF9SxYU1u:zZlDfp1Ce/dsbKryP1ZegULF85k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647675, "uuid": "21c72e91-3a77-4187-a16f-fca88773646d", "value": 660087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647675, "uuid": "a775e542-83ae-4a78-a65e-587e9b098592", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647675, "uuid": "6f1ec9d0-bad1-4f08-bbb8-c88d4b7df43b", "value": "DHL_RECEIPT.PDF.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437ce6e1-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623654484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654484, "uuid": "24e52f65-219a-4f1e-ba07-2e5514ee74ed", "comment": "Malware payload (RedLineStealer)", "value": "5fadd583b92b33403dec2566d5e94fa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654484, "uuid": "f848a8bf-4c45-47da-b56d-2e2941b550ed", "comment": "Malware payload (RedLineStealer)", "value": "03577d17dd44e6dbf63a555a3ae8de4cced57f237980fc2c7a74edac2f66d29c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654484, "uuid": "f15784d7-6be9-4717-95cd-fd6ab1429678", "comment": "Malware payload (RedLineStealer)", "value": "b9d4f68da1aedcf9229dbd5dd9a9af881d304a65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654484, "uuid": "c16dc7a8-bf09-433c-865b-187290eb1bd5", "comment": "Malware payload (RedLineStealer)", "value": "de9bd3f200aae18d7312f1e23075a40501d25dec305ded4d4a2bf13a45726849a975263a8daa6b31f2934dd1ddff7236", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654484, "uuid": "d0402b72-aab4-4b0f-86c4-a22a1f052d04", "value": "69658D49F39589C5F2161031A0739F3A5DB63C7E29B5A3AE350CB03A2BE6600456FF5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654484, "uuid": "a4c9d331-d8c0-4fae-b7b6-4cd0ec939835", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654484, "uuid": "bbe84f3e-13a3-4a47-8e30-b13e08e937f9", "value": "12288:FxmhYPot0+llXo/VlLj4l7UHtJymnKzZecc6bDSgtJQfL1294wbuQJKrbJ6m4cDs:Dmyo0+l0L0tUNJyoGLDSAJQD8JbYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654484, "uuid": "34288c55-f09f-4d7d-a393-4c23dbefb218", "value": 1423360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654484, "uuid": "a412ad31-c2d2-4d2a-b210-813b64516dfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654484, "uuid": "a4ac9191-b613-48b0-a135-7781bc00a8cf", "value": "5fadd583b92b33403dec2566d5e94fa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccbb62d-cd1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623680994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680994, "uuid": "0d01048d-7843-4a53-98c0-0d133ae43def", "comment": "Malware payload (Formbook)", "value": "3e212283c8f1fdbbe2334ba3b59cab2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680994, "uuid": "1b25f914-27d7-4137-aeba-31955ecca461", "comment": "Malware payload (Formbook)", "value": "049f2bcbaa6d18cf9ee22b12c47ba8578c938d04df6d35a3c4cd3ed81fdcf4ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680994, "uuid": "70979d15-e623-49e6-b5d6-72f45cbc0cbd", "comment": "Malware payload (Formbook)", "value": "00d79cc5f489f6cf35c9d12accafdf11393b399c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680994, "uuid": "f7e6da9d-1a98-4a64-8fe8-59bd74df9cc3", "comment": "Malware payload (Formbook)", "value": "b32ac6e2c990f268181d996aa2de4147c81debc51fe53b0f802cdcf69de50180b9dc967bbdf89a1209132f0ede696225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680994, "uuid": "5a696456-24d9-4d5b-81d9-70ab6a776230", "value": "0215E02613C89B85FA7E47789165419083F1F92BD326EBCDBD9904DD0BA0F818363B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680994, "uuid": "b926dce0-f6b7-4968-8d72-57b5bdc448c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680994, "uuid": "24be25a7-1380-45ba-9793-9b09307e9b1a", "value": "24576:4llcpVATLMqmD6lhLuTC9y0Q512Z2qlkma:LOL82lhLEC4KZ9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623680994, "uuid": "c2b473c3-95bf-4c84-960b-1c8c1e3577cc", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623680994, "uuid": "0b2823b4-d496-45cb-9853-c5f6e0cf03b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680994, "uuid": "72b9641a-a437-4bdd-b4d1-4f8ef64cd8c1", "value": "3e212283c8f1fdbbe2334ba3b59cab2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e85fc72-cd24-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623684272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684272, "uuid": "a54548c2-ba59-4553-b52c-59aa1be0f6f6", "comment": "Malware payload (Quakbot)", "value": "46bae6e93f94d6f4cb29b7eee02d2334", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684272, "uuid": "28fc3fd6-8183-45d6-803d-cd5cb8cdc4cc", "comment": "Malware payload (Quakbot)", "value": "0738038e5688c3a29e00ed1ef5984df60dd70bca5603e6cf1ab37160d107fd1e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684272, "uuid": "351fe17c-b6fd-4b77-9f67-c9047f5df338", "comment": "Malware payload (Quakbot)", "value": "358a439df5c25a21076fb9d708e16fe68b8ed72a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684272, "uuid": "109f863c-3d5f-4c5d-bd86-57831d3ea78b", "comment": "Malware payload (Quakbot)", "value": "2a9d9e2b3176288ec351293ef7e3b21b76cd2dc65468e5ca8bda0adff32c0e1c73ae7d0d8d5c0edb2d25a9a5a682273f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684272, "uuid": "4d4fbbfa-10e7-461c-b35b-c4f017a62e65", "value": "4935BE41B585F836C12519395F84F6E50B6CBC244F69268F37C91FAF6B3D2830A2936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684272, "uuid": "28f94140-2d22-4d2b-b065-009b9211d39c", "value": "6e1334af14515d2fae56a542c908133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684272, "uuid": "b33af67f-a30b-4c31-936f-a05f4b22f74d", "value": "24576:mDc3ZBXFdNMf6ndhFe3KYNdcyI5i7m0EEOy4TFqE:mkdKf6ndhQRzI5iAEOBFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623684272, "uuid": "7061b21c-4876-4155-8ea1-4391602c7e04", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623684272, "uuid": "7d2e6cd5-afa4-4d6b-9f54-524c4b18a920", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684272, "uuid": "0d32e4da-47a5-4e7a-a7cb-68d3a9479bf6", "value": "46bae6e93f94d6f4cb29b7eee02d2334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beaeb466-cd5e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623709237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709237, "uuid": "a1ecb726-05db-46bb-b0f5-286eea4d9254", "comment": "Malware payload", "value": "b1d739d1b0bd682d924cb25d8993c770", "object_relation": "md5", "Tag": [ { "name": "HalfAndHalf", "colour": "#531BD5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709237, "uuid": "edb8c1b3-ff28-4d1a-9736-05f194b21e13", "comment": "Malware payload", "value": "089a37e0c375ac1034cbdbaff9499e383cd4747d0fdfd717edf467b253589d39", "object_relation": "sha256", "Tag": [ { "name": "HalfAndHalf", "colour": "#531BD5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709237, "uuid": "af477921-ead0-43ae-a701-22e019687914", "comment": "Malware payload", "value": "3ef95ceb4c55984722dd53c05bb7d485db924af0", "object_relation": "sha1", "Tag": [ { "name": "HalfAndHalf", "colour": "#531BD5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709237, "uuid": "a15a508b-d603-4048-8773-24dcf2684fca", "comment": "Malware payload", "value": "2ecd1715f1dcdc449e5cadbc6a177b035e77ef64accabb1a3df95e8571bf8998506115abdf9d07335aa66e220f786c4c", "object_relation": "sha3-384", "Tag": [ { "name": "HalfAndHalf", "colour": "#531BD5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709237, "uuid": "91bfe80e-b97d-4478-a126-ceb5e2c14463", "value": "1D51B6CF71C9E172C0433A35240F593ED9656585C32AE466F403C3E829D98BECA2BF49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709237, "uuid": "444fe5bb-24d6-4b6f-9bba-23968aa41fd1", "value": "48:WQPXvVPp7VnJYznrAYmGoWWtPcIiccV5ad/wsDXP3EAQNMgD3s8HEtfVnRts4U+x:vPXdpArAmVWKIir3w/wsBSpBAN0XIe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623709237, "uuid": "4a99e148-a17f-4901-8f82-f512dd434152", "value": 3019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623709237, "uuid": "9ef10a76-1839-48b1-8ad3-77a65f3d3ac3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709237, "uuid": "8bba5987-edab-45fc-b8ea-2d30eea513e4", "value": "serta_credit_agreement.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006309b8-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647070, "uuid": "4aa35f89-2e3b-4a62-ae18-561762461c45", "comment": "Malware payload (AgentTesla)", "value": "ac54156a7e43cf2ff559eccab719cd56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647070, "uuid": "08d121c2-7e2c-444c-a38a-6b192cf98c6a", "comment": "Malware payload (AgentTesla)", "value": "08c7314bebaa8766553ecedf92db572d0c434168dd9721967c9d11a48ca4e679", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647070, "uuid": "cb3133d4-0585-4d08-8cd7-57063a9b618b", "comment": "Malware payload (AgentTesla)", "value": "fac611cfa9eab717732bfe55c76a3c5e9ebbd6f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647070, "uuid": "9a2dcab1-3d2a-4bc5-825c-82f33768bc82", "comment": "Malware payload (AgentTesla)", "value": "42338afc15c992442e59e2e8b8884eeb5d2d73e87ce79b278718ae942151173686a79f5dc4c6c2fefc76132789344282", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647070, "uuid": "686f51cc-9d7d-4c3d-be3d-6937e3179f74", "value": "0944F23B52872541E9D20FF66DA05D7AB4FCFB40052F19F3A9452E3FC849B8ADB22215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647070, "uuid": "d7aa8805-82fb-42b8-bedc-77704acb7e20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647070, "uuid": "0bb38eb8-8fcf-4034-a18a-0015a10ded5d", "value": "6144:SigI1J4iuRpiOIU+S+nRFfpXujHy1lSSz8twyM3Cuj7NkhJU1:D/4iuRpiTU+S+nRFfp+jdI2BM3C27gU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647070, "uuid": "49832c89-0d83-4c9f-af27-71e657856dc9", "value": 264688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647070, "uuid": "4b498508-e143-42ce-b1df-394dc6e5d585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647070, "uuid": "4c73f357-184c-4304-8e92-6a856d1221ae", "value": "IMG_003_166_372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf47749-ccfd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623667679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667679, "uuid": "69e4d257-b7a4-4142-9b7c-10ca9e852ef6", "comment": "Malware payload (AgentTesla)", "value": "eede66cee6c6dd059dcf619357782889", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667679, "uuid": "54ff031b-f50e-4622-a2c2-2c1ab09e7102", "comment": "Malware payload (AgentTesla)", "value": "0ad895b8a85f4b9b4100f04211b80537d296e5866ffbf48dc479ceb1b18478e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667679, "uuid": "24059cf9-3623-4af1-aea2-fdc91d914463", "comment": "Malware payload (AgentTesla)", "value": "3768fda115541d949961f5bd75a9be772b362bdc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667679, "uuid": "70dbd887-f57c-4aa9-975f-0043fe399f94", "comment": "Malware payload (AgentTesla)", "value": "fd95650f2d278df77c7ae8b2c5a356b0f7a08801e9ea0a820e1bbcf875d47b717cfcf9acb86ee9d1a24477fc7ad8cf04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667679, "uuid": "c85e1207-186a-4b69-920f-0f7064ad744f", "value": "C42412923AE98473E40A03731DB74F7BD6B763011F9A0B476BA00F7979511C2DA1E6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667679, "uuid": "eaf25685-6c26-4a7a-848b-2f87b02853ed", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667679, "uuid": "75aa8bc9-00da-4a22-82bd-a10c369e2764", "value": "6144:Ds9e8JnwVNJlMhVGNO4qW532fuw2Wg6MjvmpWPCTr:ye86NJlSVQTqW532fx2T6avmphv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667679, "uuid": "b3d7f0d3-a838-41b0-be9f-751f88153df3", "value": 225862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667679, "uuid": "bebf950e-3a40-44d5-aea3-b03c0e94d6df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667679, "uuid": "1380296f-a4e2-4826-8fab-0b68f7e2bc03", "value": "DHL Consignment Receipt_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8f6e6a-cccd-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623646851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646851, "uuid": "5bf5661f-7d14-4990-970c-6323a129667b", "comment": "Malware payload (OskiStealer)", "value": "f71221bb881348c3794e957d08870707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646851, "uuid": "8a627419-87dd-402f-ae62-97582a719fbf", "comment": "Malware payload (OskiStealer)", "value": "0b452d3d4f3a9bfd6ae718892f9f2ee9cbaf9103247a2d70755593dcbb21d222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646851, "uuid": "c94c1518-319b-4b69-bce9-dd17be47a554", "comment": "Malware payload (OskiStealer)", "value": "2d95a8c9a2580ecf14409b6303b240fe952ff303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646851, "uuid": "1c3582c9-1d3a-4901-a93c-9e1740edb0e0", "comment": "Malware payload (OskiStealer)", "value": "925b8b466d958a8c92b2d211df500894ca3862bab09406d7730899e49bf0987074af94b1d980c42b5c820e966f63f400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646851, "uuid": "48ed11ee-14a6-4296-90b8-8505bedd543a", "value": "403412A1B4E160E3FCA157B203FBDA3ED676F104165125DBFFAD6FADDA90243401A092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646851, "uuid": "b488e347-4207-466d-966c-dd8d1e74e72c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646851, "uuid": "f4cbc5be-c7ce-41f3-8392-354c54fea401", "value": "6144:ksZRnuPdRzet8Ba9a706RWj7myQYoK/qqw2H2iMR9q:3qdRzeSBdgoiyfYb/Dw2v2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623646851, "uuid": "8ce9d03e-33a7-4289-b579-4ca8bb51a669", "value": 252242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623646851, "uuid": "3669e590-5dda-45cf-a9fa-2b8df59e5e45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646851, "uuid": "33efa76e-565d-458c-8bbb-238a453abe8c", "value": "RFQ-G-4786.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96637df2-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623658918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658918, "uuid": "b194f06c-b376-41c1-8670-49c9d5fa7fcc", "comment": "Malware payload (njrat)", "value": "c45299ac3890bc23fa8e22ce327824e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658918, "uuid": "4c4248b2-4bdc-45d1-bc0a-ac4ff3ced4a4", "comment": "Malware payload (njrat)", "value": "0bf2aa0539156c46c1ea0ddd318405a5cc2ef1810b5d9ca624ba37c6aa78f8a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658918, "uuid": "bb48dbde-dcef-4890-9f3c-583a245bafcc", "comment": "Malware payload (njrat)", "value": "45b771d424b996e630a1810fe492c596ca686014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658918, "uuid": "5d8393f1-b9e3-4b24-887b-1c4979428d63", "comment": "Malware payload (njrat)", "value": "1509840ed6b775583a4d7ccd5e09f5653456df4bfefd81bddd2c347378cbea0e8d1d11bed0098f5ad982a240e3a988f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658918, "uuid": "28b8e88e-84c7-4392-941e-cabe144b863e", "value": "07159D2523C4AF99F13E877A51281408A3F6BC23E736DE49FDF510DAA561F41C6E2A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658918, "uuid": "45409ad5-5d5e-4f80-939b-df94aa05b15a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658918, "uuid": "173243fa-38ef-43ff-8fae-2082774566b4", "value": "12288:RkrOMZl50I1ZmhuWyRfzwjjF2c9aWnaXWhiYrXdTrXdJZM4e/ZUdtb:RkaM1mw3R7Ujkc9aWn7hZpDNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658918, "uuid": "a9fede72-833b-475e-92b5-9653aa270f37", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658918, "uuid": "3346697a-ef3f-46b3-9fe9-b384540e3520", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658918, "uuid": "eef80968-3425-4ba3-8af5-b7b7146a0f42", "value": "c45299ac3890bc23fa8e22ce327824e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf7bfda-cd13-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623676993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676993, "uuid": "3b381951-d9f1-4e66-996c-c243dbdd8541", "comment": "Malware payload (SnakeKeylogger)", "value": "bd4cfb6327a67c6ceae58540af69593b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676993, "uuid": "9b37fd38-a29d-4775-aa0b-20a74be84395", "comment": "Malware payload (SnakeKeylogger)", "value": "0cde5114e21998bbfd42ce2e72b04ec7acd82535dcc3e1707e9ae77bfbd55226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676993, "uuid": "f89a7f61-1022-4ee7-9604-f0576a6a8281", "comment": "Malware payload (SnakeKeylogger)", "value": "cbebe6abe0f798b7e63fde8e6c2a371d190fb714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676993, "uuid": "340616ae-eeeb-41d2-80d8-61b09b96eb19", "comment": "Malware payload (SnakeKeylogger)", "value": "184dceca8c550fe5d6f6bacd13a34cc1517bc93f12fcc98c06c915bff5bcf6e882d365f783625ca7f4754d52867ac577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676993, "uuid": "bf52dd65-21c7-4ee5-b77b-0ef5f8de67ce", "value": "D3C3084D2BF89C00E6FE8A7315B15120CBB5BC51096BCE5D4BC1F8591A7D6908E26FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676993, "uuid": "878e2ea7-1111-405f-aaba-99183c65fed1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676993, "uuid": "5b681778-abf8-4a1e-831d-3c2f8741634d", "value": "3072:YLqkmsPEaAoWVg/aD1CgGV2EbSRihZ0fBBwi:XF1VgCD1XI2EbUifkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623676993, "uuid": "c5abf43b-6ac9-497d-a48b-e0f76744cee3", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623676993, "uuid": "06077686-799c-47fa-9ee0-26f968f51256", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676993, "uuid": "5375f186-8070-4a1a-bd2e-df4a07de9f81", "value": "StubV4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd59920-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623652062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652062, "uuid": "99ca02ce-7da7-4466-bf9d-4ae688ee6e9f", "comment": "Malware payload", "value": "94c6450e05fdd74624431c8c5de8a33a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652062, "uuid": "9fd01d3f-58d5-4725-be71-3a5a41859765", "comment": "Malware payload", "value": "0dcb15bed090aed6e679e188b87308ae4754bb2f0b91ef8a6089729c54d40dd3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652062, "uuid": "4e61cd3a-0561-4c0d-b116-740e9aed19af", "comment": "Malware payload", "value": "efb090e795788650880a09087e3adb2730cb6b82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652062, "uuid": "5c4498fd-9eb8-46e1-a927-86c6834b0bca", "comment": "Malware payload", "value": "2f2152803afc7c5c168cbed002ff2f814e561b3c39b2fb16853e16f6e67f917a1a8514bc1983f9d0fe729fcc23cf4f15", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652062, "uuid": "701afdc9-8e32-4d9b-971a-81d676588e54", "value": "14226D6CC10AF829D222847EF01542F5F62A50A2B261BB7E204575CC1A517DB9BCF77A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652062, "uuid": "4a36538e-116a-4ec9-8b8f-6d754cad84a3", "value": "192:ScIMmtPtuP0G/bsFfYAwOLz7rx51zcOJn3LsJ:SPXELsZYAwOLHWOJ3Lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652062, "uuid": "495a4cac-8e46-42f5-a27f-984d06e38a03", "value": 10331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652062, "uuid": "d7058193-1178-406e-8bfc-e43a5e12c6b9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652062, "uuid": "cfb9f506-262c-400b-958d-7fc4918659e7", "value": "PO-ENQAQT390230220.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59763055-cd5b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623707779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623707779, "uuid": "ef5026cc-4ac2-4c38-a2f4-19fe1af14fe8", "comment": "Malware payload (NanoCore)", "value": "5427c2b4b89bbcefaedd38d1b78918f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623707779, "uuid": "ea76f81d-309a-4374-9f61-e732a434c754", "comment": "Malware payload (NanoCore)", "value": "0e199beeeaa44ff864a48305db41866d4094fe849efcbe9e725046739160fb4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623707779, "uuid": "2d1ff73f-f7fb-4a87-a561-110118ca431a", "comment": "Malware payload (NanoCore)", "value": "4b07c26e4a983105fe8136744767ae28ffae80c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623707779, "uuid": "9355942a-0e0d-4041-93f7-5cf8b59a08eb", "comment": "Malware payload (NanoCore)", "value": "2796a41b066c7b3160676a7482111b68993ae377b48ec4df15f0beaec4521d873f67da5fc0af18252b2c210b3b9b8e40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623707779, "uuid": "85b908e6-f809-445c-94c8-5e86568edd82", "value": "996416CB2E5446BBD38DF57450A3733D432F89BE7BC3AE8E949B2D66573229C4506082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623707779, "uuid": "931f5b05-c294-4755-af43-1dc5efe3d444", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623707779, "uuid": "6ba17e91-e717-4a31-8f6d-b0bc97104617", "value": "6144:SLV6Bta6dtJmakIM5rFmHi8ieZv00yRQ+E2cV:SLV6BtpmkcFmC83KWH2cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623707779, "uuid": "849d879f-6a34-4166-abb0-8af339e50bad", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623707779, "uuid": "f8d50421-2ae7-4302-9936-3c0a37cca74f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623707779, "uuid": "e1aa87cb-3394-412e-a805-8ea295d2481d", "value": "0E199BEEEAA44FF864A48305DB41866D4094FE849EFCB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333a08d7-cd0e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623674643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674643, "uuid": "10a8a81a-38a7-4b2b-87c6-151f545873cc", "comment": "Malware payload (Formbook)", "value": "df75f88b30020d1128ec273659993534", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674643, "uuid": "05ba6316-201d-4a50-9073-dd9d0b3ebf90", "comment": "Malware payload (Formbook)", "value": "0eac20601fbcddd66a10987ccb8103dca0e71882042b47442f05305d6ceb208e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674643, "uuid": "12cf818e-7c08-490e-8ed0-a5ed4cb8736c", "comment": "Malware payload (Formbook)", "value": "e851da6d5a3c5e81003b92b9c91268fa67acffbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674643, "uuid": "d3a2d185-2844-42d0-9f3b-d76f43ba52a1", "comment": "Malware payload (Formbook)", "value": "531455b47f485ba27776ffbd152d19c175dfdf7814a6621a606a25e1474f048d0035a799397dc1ed350a7a7cce433909", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674643, "uuid": "7322362d-c1a7-4339-95d0-f26af5911dde", "value": "E445C012B255896AD02E89344472D1FC01F1FF8E6A68E75B3DC07A7F6D72384DE62B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674643, "uuid": "d4dd3ba6-e47d-4a37-b04f-d67b24d1d7b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674643, "uuid": "edfc0fdb-2b39-4722-ac73-e81613e8656f", "value": "12288:aiJm0MkPsXgsJXoKRk9+yF+IxrSEJTFDj2sa2EHLfR4md9VCZ6vP:aiJLMkPsJXnk1+Ix/Jdw7vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623674643, "uuid": "46db7af5-caf6-4f61-b0aa-d0950e21c12e", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623674643, "uuid": "9c2648f6-a02d-4172-b1d0-d495932df5e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674643, "uuid": "3427c014-b87a-465d-8068-3ef0ac93b746", "value": "df75f88b30020d1128ec273659993534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d68825-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623658270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658270, "uuid": "8408e219-b30b-4758-8d2d-00c6502ce3f5", "comment": "Malware payload (RedLineStealer)", "value": "1d7192df4040046a2e05ae7c889a08b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658270, "uuid": "6d42fea0-8ae3-4f0b-850a-f0982ba9c72a", "comment": "Malware payload (RedLineStealer)", "value": "0f3dfc08cd90ed2eaf654baf1285bc09c9faf8f40dae2c52ecbe2553353ab5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658270, "uuid": "f2e8d78b-818f-4b56-8cc4-ad7ed1c62c2b", "comment": "Malware payload (RedLineStealer)", "value": "e5bb8db5ba6720b1e2989481fa7214987dd6d28c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658270, "uuid": "fd8f8a08-37ba-4d97-af39-f5ec708241a7", "comment": "Malware payload (RedLineStealer)", "value": "4a1639d027ac69158dd1144d275e49e545fb5ff92e7807171954263b469b98c1782f9466e6c2aea4bce9c8dd44181886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658270, "uuid": "8d587837-550c-49ec-a98f-c62bc1143d1a", "value": "6C84BF10A750C0B4F1F352B45A7A8FF8D6ED7AA1AB3494CF52D12AEA56346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658270, "uuid": "a9dc5857-9db1-4dd9-8111-a62c1fad4cf3", "value": "baa7acc629fae892f4f615c8c37bd06b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658270, "uuid": "4cf47f36-0196-441c-ba9b-d3ee8d1bca1e", "value": "6144:4s00267pOPWIeSD+PlXKH21oPq7eizIcsfLwrpgFPfs9X+yQXyZk0Gx1YzCR:4r367pOP24+PlaWaPCsU9gF3sF+ymyS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658270, "uuid": "f1f14893-46db-4491-a5d9-8984ee0194ec", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658270, "uuid": "683a0eae-bf52-4a45-b887-d500b62c6596", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658270, "uuid": "9d3b1f0c-8917-4bf8-8f1c-589dd3c5490e", "value": "1d7192df4040046a2e05ae7c889a08b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044649a6-cce6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623657385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657385, "uuid": "6afaa33c-2c93-4b44-bb4a-bbc2f5317d5a", "comment": "Malware payload (AgentTesla)", "value": "de18b8d101d2c49540011230a16621c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657385, "uuid": "75e45a48-5a52-4f39-ac3e-2f1936b8f519", "comment": "Malware payload (AgentTesla)", "value": "1052875c57a9dac5930db4b7a769cdebc01fb2df98c5105454893ce570599962", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657385, "uuid": "539665d5-9eba-4721-8204-94b1a97cb482", "comment": "Malware payload (AgentTesla)", "value": "8a1fe33dfc3d7e68fe7401b224b27788ec90245e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657385, "uuid": "d21276b4-6226-4e6a-87ed-611b7f983275", "comment": "Malware payload (AgentTesla)", "value": "141e35df2435b99529dac03b8c2479b5b36f560de53e51c8622e0a40fe484725744ba623d3c295a98f22de93265376d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657385, "uuid": "fc12a6a3-79fd-4f7e-b3e7-8459c982c91f", "value": "BF15F02132C82BA4C5BE6B798676410093FBB91BE731D64D7F9D609D2B23F41CA72B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657385, "uuid": "2737a050-09e3-4f8b-9f75-9b4f147f4917", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657385, "uuid": "3c7df9e6-1b32-4ff9-9ee0-1fe1ce4ec76b", "value": "12288:mwxY8OumuQ0rJgsU4X4qPUvsjkZG4Rgnc9uQuqK+ETEcMXAJmqWuEy3sUljfBJZF:m7urfrJ95IqcKcQ+UmFly3s4NeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623657385, "uuid": "d3643f07-de03-4d6b-a5f7-92030f9bb441", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623657385, "uuid": "8c90f45d-5684-49a9-a58c-111cd1bddad0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657385, "uuid": "14df07fe-b332-4ba3-8933-b731bf98e870", "value": "de18b8d101d2c49540011230a16621c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8493cb39-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629253, "uuid": "5a554c6a-5b7a-40b4-b5f4-395f196dc189", "comment": "Malware payload (Gelsemium)", "value": "87eb0975758ecef44e8368914cffe151", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629253, "uuid": "76a47922-78bc-47a7-89a4-e220b03f6a80", "comment": "Malware payload (Gelsemium)", "value": "109d4b8878b8c8f3b7015f6b3ae573a6799296becce0f32ca3bd216bee0ab473", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629253, "uuid": "72b78fba-17a4-4ae3-87cb-0427cb98f50c", "comment": "Malware payload (Gelsemium)", "value": "bca97bf7e93309e49311701b22569395b2baecc7", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629253, "uuid": "9253a224-d113-4e9b-beab-dfa36d301064", "comment": "Malware payload (Gelsemium)", "value": "12df3eeaa755a9711d66d9cf3d77bc3acc8d4ec98c73a85ce1b1f485c9fbfcb2b3c5ab2b20c1b4b330b06a487d6d1c46", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629253, "uuid": "016cd667-c3e5-4f6a-838c-da0e0b0942b7", "value": "28B4F15F6BA605D6F436AF3F85DA963746BBED120C09F35BF238AC8B1D3068150112D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629253, "uuid": "2370ba96-5cb4-45db-a009-f088bac0e8c7", "value": "454bc8c03d75cdb03054b29514beb2e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629253, "uuid": "eda80c12-dc37-434a-af96-2a2b27af585f", "value": "12288:cNLeyMnZhkT4gBNExraqTOC50K511CdeS9JeuGvDXmDeCmw9Y:cNsZ+T4sEhlOCfP1iX9dOwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629253, "uuid": "39c0d35f-c887-4cca-a8db-bdffdf832f3a", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629253, "uuid": "ca283a23-c495-41de-8c7b-319ae893ecc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629253, "uuid": "fd8d5446-a308-4e09-9927-bc86bb6ec013", "value": "109d4b8878b8c8f3b7015f6b3ae573a6799296becce0f32ca3bd216bee0ab473.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f93d6f-ccc6-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623643862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643862, "uuid": "24223522-56a6-4edd-88e7-617b316f793b", "comment": "Malware payload (NanoCore)", "value": "7e84d7ce0949f2262aa4a595a5c23359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643862, "uuid": "67d4e01d-172c-4ff9-8dfe-144f0e734f4b", "comment": "Malware payload (NanoCore)", "value": "10efd1ade011c375354e4c00208925e9e407e42ec7bcbf7ebbe59c005f67915f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643862, "uuid": "1dcb8a77-e9ea-459c-82fa-f07e09e23c06", "comment": "Malware payload (NanoCore)", "value": "04154c58e9500543a6e3f1ef9fdc929e25244934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643862, "uuid": "64e04067-3373-451b-abb6-698576569b38", "comment": "Malware payload (NanoCore)", "value": "8923c008e73887a344413b4088ffb93f0abf53928fb3052e76c75280f40ccb03e44be350fec1551ef2c3769047e95e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643862, "uuid": "9ff5f2bc-28fd-489a-8c30-01f278034e30", "value": "DA55D012F5109A6AD83D8B344432C1B802B2FE9E6A38E65E3DD47D5F3FB63C5D522612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643862, "uuid": "df00e94b-0f38-4590-b838-2c6279f0ca87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643862, "uuid": "f53d95a0-6f60-4187-b08a-053df06594e2", "value": "12288:GNveDMkPY6K5bawz01eRc1kPJC03bgT9WVth5MrtHaemx9VCZ6vPhlgrdm4Vz0Rz:GVIMkPYr5baA01h2c03beyUBHaB5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623643862, "uuid": "be15f506-c84c-4fe3-ac07-88b9f9903853", "value": 1382912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623643862, "uuid": "e8a0deeb-1c5f-4b81-aa46-3cfb031f3668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643862, "uuid": "d11c6dfa-706a-4919-97e7-c398919916b4", "value": "Excelkos Sdn Bhd - PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af62f16e-ccb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623635338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635338, "uuid": "43c494f8-48ca-43ae-bb2d-b5d964eda785", "comment": "Malware payload (Gafgyt)", "value": "8f438a60ef716f52cfc886ec53346a7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635338, "uuid": "eeb33aef-869a-41c3-b962-d042946afb03", "comment": "Malware payload (Gafgyt)", "value": "121191aea9560df7d2a365d4c94a524bbf94d69bc59b0e2ba9bfda93db50184c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635338, "uuid": "24ffe537-0a94-4758-bc9d-d665af0d23fb", "comment": "Malware payload (Gafgyt)", "value": "e49ec4c2ae1518f49c3682db74197c59851d1bf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635338, "uuid": "fec1a4b3-8501-4772-8439-f6f47038458a", "comment": "Malware payload (Gafgyt)", "value": "eb7f9b0377eab57da224995ed73aa39d62cb8b5e8c6029faa953aa6d4d60f056f9334abee47d8e13852936bb68ae8e37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635338, "uuid": "3494cd78-c07c-4d40-92d0-a322b8c76503", "value": "D3A34A82A780D5B3D19306F6129B8B150133FB3F4A6B9EA6F35D3CF48B509C17261B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635338, "uuid": "c25d0a55-729e-485f-af3f-224edfa8e205", "value": "3072:l8oqodUWUh917j8mc2deiPUDAZURyPf35h/Twvxinf0OzTyoQQub:ldRu917j8mc2H5Z5PP5h7mxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635338, "uuid": "dc6ccfb5-10a7-4549-a65c-0cc4bee7b03c", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635338, "uuid": "cda56170-5597-4b81-aa3f-ee919b2b7bc1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635338, "uuid": "1429821c-2508-4761-8edb-cfb73c92fb2d", "value": "8f438a60ef716f52cfc886ec53346a7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df8e4b6-cce3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623656220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656220, "uuid": "0a8df30c-147c-4c07-905a-40e8006e4f89", "comment": "Malware payload (AgentTesla)", "value": "666121c25a75209282a50e4260bed437", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656220, "uuid": "bb62d2cb-a50e-4bee-a191-9bcd25d60a28", "comment": "Malware payload (AgentTesla)", "value": "12e22d718cba8621f195e90d3de6af8970792fc12fcbe5dc4aeb0a2c66e34b2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656220, "uuid": "45850a7b-59fd-42fb-90b1-bca70bff142f", "comment": "Malware payload (AgentTesla)", "value": "a0c6ef1048767624579c3134e8896fb012da3ea1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656220, "uuid": "6dc124f4-cc45-4c6b-a309-bca2553ae034", "comment": "Malware payload (AgentTesla)", "value": "8754a0437e3ac1e1612f58a97b9ddbe1953cd100a831009e36626078c758d066bd2bd315c6bb80e5567118675ef3cc93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623656220, "uuid": "fb7e1732-0d67-472a-8df3-463cb3a81936", "value": "0C911730933C6CA3ED0BA2F6C6B4FF290AE2F05699CB0540331EE6B10F3A3554626C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623656220, "uuid": "5daf9e82-ba20-4d94-bd52-75a8293cbb14", "value": "96:PYR5U1JTS2Nf5GaLsQJl6eE90tmEXQPVZtAX:Pm6S2SVet/QdZtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623656220, "uuid": "cc6b4c5c-4d5a-443f-8b74-f0d5ebd36226", "value": 4544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623656220, "uuid": "3d506ec0-6610-47f6-b2eb-f19aebb6ff3c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623656220, "uuid": "4b27d934-15f9-42c3-a90b-5e7427d54d5d", "value": "Company Profile.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c59614b-cd0e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623674793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674793, "uuid": "25240517-df97-42b0-98b0-892f2da3689a", "comment": "Malware payload (RedLineStealer)", "value": "f84f72b76739ed1fb3e41616f5167dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674793, "uuid": "c8790f28-11e5-424e-9a8a-16aaa57c293f", "comment": "Malware payload (RedLineStealer)", "value": "13cbfcca93b6700d7a32d6db67417a27a6ab366a305cd54cc74d5172bb0e6d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674793, "uuid": "46b1334c-8b1e-4e70-af22-076bc6a7812e", "comment": "Malware payload (RedLineStealer)", "value": "b72fa2eaf0dac80a46d141b011be7af55abf5560", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674793, "uuid": "5b2c5e91-ea30-47c0-9705-b5984120682f", "comment": "Malware payload (RedLineStealer)", "value": "8d0e1f06e142adbcfef34556b0f124de8c5acafd9b2c64cee6cf83eba822f46ba5569acaf5013fbb99cb5e747a692770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674793, "uuid": "4e7d34c9-cd7f-406c-8659-bdfa7395538c", "value": "4264C3E43B581D33E5BE17FBE08109D1C3F552866A4FEEC96CA51AD52EC6781CA1308B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674793, "uuid": "9af621db-92bf-4efc-8494-259395613b05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674793, "uuid": "8e1b0cd3-3183-476a-9f32-478781504d61", "value": "6144:6yL/YNGYPHgva25tstOBssugCt1aXHTO5sKZ26AgIwVhdRb2:PXY/gv95tstOBzugCtQjg/dR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623674793, "uuid": "7ad3c4a1-2d14-4917-8892-bf59a1d1b345", "value": 318696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623674793, "uuid": "f7cce021-afce-4475-9dfa-2ddcbd92e9c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674793, "uuid": "b6924c8c-200c-4063-9c57-c692a0e64ad3", "value": "b72fa2eaf0dac80a46d141b011be7af55abf5560.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d775b1a0-ccea-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623659457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659457, "uuid": "3d3132f6-7e0a-4d4a-94a0-a468da2d92fa", "comment": "Malware payload", "value": "57e99114760c54e3b6659dbce7d9bf1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659457, "uuid": "400b7fde-8f20-4c1b-96ea-3c885b87cc52", "comment": "Malware payload", "value": "141f1ec941dbf58e62345d5ad6c70b01d3639e4c1c6fa88ac2f38c47c2e16078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659457, "uuid": "a69283b3-8a3a-4422-91e3-c58ce2c65efb", "comment": "Malware payload", "value": "783932948dcccc73ecf876552d11d42f8f79e2b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659457, "uuid": "5ae346d2-fed6-45aa-99af-934a3a215047", "comment": "Malware payload", "value": "54914cc6c3b8d825d2c14c4a1e56ecd559b9ece33b073cf7fa264a75e6a530a9446f96a4533a8e75060fc1d3b7d20d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659457, "uuid": "ebf8ddb9-ab0d-4b9b-baa4-da187d037389", "value": "B905020063A2C0B4F1F716F45A7A9EB9E9BD3AB0576490CF63C516EA66346D0EC30727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659457, "uuid": "71763014-266b-4c92-b99f-60f2279e894b", "value": "76567453f097005b8c49393a915ef4ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659457, "uuid": "a1e20e4e-3441-4a30-8178-d91ab2eef25d", "value": "12288:Cw+izvLrmf543gHE9KdPn6bQ+ctqbUTJHhr26JhPrtxmo4FDayolHUFrn3IOvzTz:CZijLsHqKdx+fsJV2m2DajlH8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623659457, "uuid": "f811748f-9c89-459d-bbce-abf39fcc593c", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623659457, "uuid": "8cd0bdea-e4f6-4e27-860c-7081f97c0d5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659457, "uuid": "5702eaf1-3dc1-4700-8db4-1a2b8ad21f9b", "value": "57e99114760c54e3b6659dbce7d9bf1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b48074-cd15-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623677763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677763, "uuid": "603fcbe7-805c-4cb8-8cfa-d8a301ba89fb", "comment": "Malware payload (AgentTesla)", "value": "f9f02646aeeaa754474089a00d07b0e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677763, "uuid": "fffa4e04-0a4c-4de3-9f42-7a77d5446127", "comment": "Malware payload (AgentTesla)", "value": "155b4185bb15fc8726e6abb06ffdcaf94d3dc44b7828ced545b30b3885e15033", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677763, "uuid": "6d796ea5-4e0f-4903-8c06-86cd7c2c5f37", "comment": "Malware payload (AgentTesla)", "value": "d022ad56d9704e0fcdb7d4738b40de5bac7d40a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677763, "uuid": "372b7d4f-bb99-40c2-a5d0-f6e5b3f9b889", "comment": "Malware payload (AgentTesla)", "value": "9217463b822446fc001e52a06c92323e88e8a4f81d4878d91e488145fd4f5671d693fe6c0a2dd2e5f2b8d1626348224d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677763, "uuid": "d4942b91-228b-4cba-8aac-6d7ebcda9386", "value": "CAE4D039B3847676C6190F7BC1130984D3F0E2477232FB5FA6E826D84E15B499B2EA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677763, "uuid": "54fbd77c-1541-43eb-a7b3-16da813e602f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677763, "uuid": "fc6dac36-da14-45a6-a8f5-2efb1d98bfe8", "value": "6144:S4/rTms7PaVIFfrtUuH8YM2RG+zcwxOVbcEkX+7srqJ9bZZl2EIWr1ovbVmIVMt1:j+VEKYM4GSYbcb+JftZIEovbVEhrJVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623677763, "uuid": "9d46b2e6-25f4-4e61-822a-07b2353ed02d", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623677763, "uuid": "303e8419-4534-4fee-8096-405d1975440a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677763, "uuid": "c4f78fd5-ff79-476c-8ad9-c9f73fe43280", "value": "f9f02646aeeaa754474089a00d07b0e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ab5314-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623651810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651810, "uuid": "742bf571-3500-47a2-ae32-8346b924fe0a", "comment": "Malware payload", "value": "a3e616e1e469c7b9b21bc3ba73d1cee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651810, "uuid": "5ed2e990-2e75-411f-af93-986e6aec4dff", "comment": "Malware payload", "value": "15d7f8157ddec29dc6008b0347ab10be31e24f3d50a40b711b1024e30082755a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651810, "uuid": "31e964fd-d5e6-40fb-9fc3-9cb531a97dc4", "comment": "Malware payload", "value": "42c9696ac50701bf5d47be22310464b35103b74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651810, "uuid": "2ec38c82-8130-486f-877e-918fd8c42619", "comment": "Malware payload", "value": "2b45ad969affcac0cbb5b8b377283c59f7fe70328472d8d905ee913a487aeaa18af119a42cb83589706bffd9ed5fd88c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651810, "uuid": "6f42adef-edb9-4a7e-a88e-b843594e9e6f", "value": "D232F9193AD8CA96D17EDA382CE3415C42F7D64F5101EACF2ECA98DE2F737844411B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651810, "uuid": "f9a0dfc3-3c3b-40b7-9764-64404b064b46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651810, "uuid": "c8267565-cbb9-48c0-abf6-3a958932a2fe", "value": "192:cz5wJYwScGAhITuk/lxuUaXaxbqHms2Z0LrfEWiasvNWx/4:M54oB5qUaXaxbUh2aHi/WxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651810, "uuid": "dfef4137-5492-4a8f-9c73-2dff98f1c144", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651810, "uuid": "a3cf9e7e-3b45-46c3-a4f3-bec61c937f2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651810, "uuid": "b9ce0d2e-3ff5-4efe-83d1-37a1c2d22289", "value": "a3e616e1e469c7b9b21bc3ba73d1cee9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa268236-cccf-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623647784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647784, "uuid": "0a3d4b1b-542e-46a7-9211-77d471dc9459", "comment": "Malware payload (Formbook)", "value": "8e88d33198d22070fb6563f7db349de2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647784, "uuid": "d3e30cda-5802-40f6-a86f-c96dd4a2999b", "comment": "Malware payload (Formbook)", "value": "15d9a7464d49d541d77a402486ca299fe77031a9dc362bcfd83d60339fd0558d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647784, "uuid": "5ba125bf-eb8d-4378-ba44-407a36574b47", "comment": "Malware payload (Formbook)", "value": "ed6a6b608253b49cf13630cb804f7c20948c8d57", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647784, "uuid": "d90d526d-3f3a-47a3-910b-8d3413ef3d27", "comment": "Malware payload (Formbook)", "value": "4e47fea899585aa435c5b34fae45b4e0af3336a9eaf539d106a5c8e543ef322466dfe774aa6afc07f6ddfed620818c33", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647784, "uuid": "23019887-6c19-42de-b5bf-781419bfe403", "value": "E03412038791C7437C39D10A05225F747EE126CA46FDA82F061A2F3C178FF57AAA656A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647784, "uuid": "4cb30651-7e2b-4456-9aa1-e9b64984c469", "value": "6144:HiOG6JkE3NpXdR0wnIdcCaIdFW3lroUCt/oj6MIDjU+:CObVN7RtILaC0lroVanIDjU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647784, "uuid": "63d5cbfd-c3e7-496f-90b8-dbf3cefaaf47", "value": 233547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647784, "uuid": "cffa7a8f-245b-4466-be08-2ddbf9dc9ba4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647784, "uuid": "aa6885c8-4a3b-4e00-a9a8-04706c595898", "value": "Revised PI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173a6709-cd0b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623673308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673308, "uuid": "bfc20ba8-5ce0-425d-bee6-21050ac830d9", "comment": "Malware payload (NanoCore)", "value": "f28c29c65b3825f144b53e4c3f943573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673308, "uuid": "2460c3c7-2119-4d00-90e1-0f206d8f06ec", "comment": "Malware payload (NanoCore)", "value": "169204fe09cc2537a253df1539d3c58b5dbc6de283813abcd62168dafd84171b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673308, "uuid": "07184121-4002-4203-b9aa-c77814d37bfd", "comment": "Malware payload (NanoCore)", "value": "98d15ae08525b4d8a93a13f5eefc4f921de72936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673308, "uuid": "c73fcbc4-3283-4345-aa19-98692ba84bd3", "comment": "Malware payload (NanoCore)", "value": "fa220b6698a124c694ba6014203c65d0d28642f75fb1d9261ea08893d22965c8082a5ff25f5c783333008998f7c83c27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673308, "uuid": "97ee5f3a-a4d2-4d41-81ec-9022d9bcfe82", "value": "03640246E385C8EBD05C0DB198A6663482F5BF974092022BA768375E457F243B87FD4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673308, "uuid": "e0803288-1a80-4fe2-aba0-6a820e31a22b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673308, "uuid": "e15469a4-ef15-4f62-b800-965f13abbaf1", "value": "6144:Gs9DLbwkJxJwfipgvn+IfJscxZuWjQ8vzB7xm:HPbwkTafipgf+If2EuSjBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623673308, "uuid": "75caff51-eafc-4d2e-8b1c-e20bac38c6a1", "value": 312274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623673308, "uuid": "218154d7-4df1-449b-8b0d-8521d98bf997", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673308, "uuid": "af81b7f4-9087-4022-af92-5dc0046727c0", "value": "Booking.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe636b5-ccc5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623643311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643311, "uuid": "dab55c0f-c399-42ed-a79d-17e5c90a7129", "comment": "Malware payload", "value": "48068f3a293fcc60c02d55f04d7aae93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643311, "uuid": "6bc9c404-c9f8-412d-9113-c61fc206d8f5", "comment": "Malware payload", "value": "1698163dc10b986e74c9e357737747c3904a789d7889354aaa3207f2c3b59f86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643311, "uuid": "d993f0ca-5c4d-4c52-9f28-a4f721b73a2d", "comment": "Malware payload", "value": "109d3ae939df38aaaee665f26162f3d5604604c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643311, "uuid": "6bb4dc23-7b8a-44a6-a245-d5c32f0989bf", "comment": "Malware payload", "value": "6b4452126e1f678092c5ffcf55cba21e1faabcbab4bf4f580e16954b9da9ed4bd09b6d78f9578c9799d4a9487c8a3b7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643311, "uuid": "d8cb4093-0066-4f57-a5b9-cc7888ca9aae", "value": "27F5F1207E82C132E5728170AD7DAB6A54F87B750B7581DBA3C81E2E0D705C36B3A75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643311, "uuid": "2bd2d480-326c-498f-9772-79b34dd615a2", "value": "d9c9b2207194e3b00f67e3fec7ad5f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643311, "uuid": "659d5104-de04-475f-b0f3-55c6b762378b", "value": "98304:e1wpL+EII1n5PSdb5EO5Rk7QzjumyCzEpqs:Ow4qZ5PSh5EOoQuZQzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623643311, "uuid": "3f0b29ab-fe79-4e5b-b9fc-2544e0a5bb2d", "value": 3634248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623643311, "uuid": "84501ba6-b48f-4dcb-8b78-6666f22fecf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643311, "uuid": "7d51637d-47bb-4a73-bd1b-80269b9d263b", "value": "48068f3a293fcc60c02d55f04d7aae93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffdc4ae-ccc5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623643553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643553, "uuid": "3011aea7-4ee4-4968-a5a0-766d73dc64de", "comment": "Malware payload", "value": "bc7522c569863c07247effeed6adda85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643553, "uuid": "8f3e5069-7625-474c-8d9a-73b74a2963ce", "comment": "Malware payload", "value": "1704f37b457e8947b989c130dc603c67d5d1d1166e2a3138698610d3f2d0bbfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643553, "uuid": "61dfd326-ef57-40a5-8d11-8183de6c9a48", "comment": "Malware payload", "value": "c24981fe4acd02e6adf1c5127dc9a6ddf8334ed9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643553, "uuid": "4794a1f3-8116-4fb5-aadd-0c7b0c60538a", "comment": "Malware payload", "value": "c73f425720d80ce3cac841480343cb77b6f82ad28efeb528143dd9db950e37f9d44087d12da4257df8d25269ec06e0a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643553, "uuid": "49559153-9963-43d2-b366-3450037d2536", "value": "48F5F1207E82C132E5628170AD7DEB6A54F8BB750B7581DBA3C80E2E1D705C35B3A75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643553, "uuid": "50ad1266-07f7-4866-9e05-c72fe92caa2f", "value": "d9c9b2207194e3b00f67e3fec7ad5f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643553, "uuid": "55c19416-9d24-41d4-9a79-8995a99e4901", "value": "98304:l1wpL+zIIQn5PEdqRj0auF2QzjumyCzEpqS:Tw4d85PEuj0GQuZQzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623643553, "uuid": "5fe546f0-bb91-48ef-9b25-9c61326edf41", "value": 3643816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623643553, "uuid": "e9f7d6cd-21c8-41a6-a414-caac67180738", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643553, "uuid": "34fe3a96-ff1d-4ffc-acb5-bd0532452799", "value": "bc7522c569863c07247effeed6adda85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddc9640-cd07-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623671601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671601, "uuid": "686f144d-56a9-4796-95a5-8091408757be", "comment": "Malware payload (AgentTesla)", "value": "8d604fa37b6810d4ee74f39aec5001c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671601, "uuid": "edc64924-234e-4773-b9a0-9319424b9a70", "comment": "Malware payload (AgentTesla)", "value": "17694002d5c5af0a4e6f13c46a9a15464dcd7c3edabd0f683771b39b20de3a28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671601, "uuid": "f11b0fa0-5306-4105-9ec5-e152f2a99c06", "comment": "Malware payload (AgentTesla)", "value": "c88971c820234f5824437ac0ac186a0008b07075", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671601, "uuid": "f0773e84-035c-468b-9986-38974d00bf67", "comment": "Malware payload (AgentTesla)", "value": "8b5df0b76ef2eef4d0d0977b5cdfb4bec92128452170022d1a867c489031d226e7c969d55fc288d2e8a8ea7e921a0c77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671601, "uuid": "049fd731-a021-4011-8ce5-ff39576a441b", "value": "D005E0262388CB85E97E07349265419053F2BC1BD725EBDDBD9A34CC0AB1F818763B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671601, "uuid": "6df03907-3e68-4418-993b-f93c2f772cbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671601, "uuid": "b4b80e6f-697a-4a6d-9f63-ac3cd3b19e31", "value": "12288:kPeHxaTLMH5VuXxpShhskLOLtRClGwu75/+fJQ4w3COE9VCZ6v:/HwTLMbop9LzClGwax+fZnOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671601, "uuid": "69a38382-b325-4a46-aed2-d489011ebfa8", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671601, "uuid": "80e73b34-1343-4e5a-8487-cb303800060b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671601, "uuid": "b96f609a-3b94-43ec-8c7d-791e672ac80f", "value": "dan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b255422d-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623652093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652093, "uuid": "e6609538-8816-4976-af9c-922e7fc9262e", "comment": "Malware payload (Gafgyt)", "value": "7451b2a699a13e5f97ff5ea1630f9ebf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652093, "uuid": "7f8d75fc-af8d-4a94-9971-3b9e3693c1be", "comment": "Malware payload (Gafgyt)", "value": "19273042fa6808e20d83f4660ed143d5062b7501f6691f482b76eb07a14566d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652093, "uuid": "39d25c8a-22f2-4930-8530-a66d6da0f6ed", "comment": "Malware payload (Gafgyt)", "value": "8e098a9adb6b700f1f66e47a022255531e450792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652093, "uuid": "b1ea17db-575d-4020-9a24-67330dd8de4a", "comment": "Malware payload (Gafgyt)", "value": "16da7127fa5bb250994580fa5c535bc3e833bde0b171306046fa67bc9418251c715128b6b1b75d44d6e114a5252848d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652093, "uuid": "3c3090b7-4687-42ff-9077-aaa3273ec3ed", "value": "7CA34A82A740D5B3D1A306F6129B8B150133FB3F4A6B9EA6F35D3CF48B109C17261B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652093, "uuid": "5567a572-6ed4-4c6a-b12f-cdcd1ec67472", "value": "3072:Hg4eodUWUh917j8mc2deiPUDAZURyPfe5hQTEvxinf0OzTyoQQub:bdRu917j8mc2H5Z5P25h8Cxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652093, "uuid": "0aae2182-2acc-4c5a-b56a-d74193b1bbe1", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652093, "uuid": "36b8c1fb-bb08-4155-b1b6-ef29f70ac99d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652093, "uuid": "933b298b-ed35-4204-918f-b697bd6c47e3", "value": "7451b2a699a13e5f97ff5ea1630f9ebf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0361ebb-cd57-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623706287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623706287, "uuid": "d8865b29-bb49-4ed7-b51c-3275fb15385a", "comment": "Malware payload", "value": "851b7b8dd006dc889bf8f9282dc853ce", "object_relation": "md5", "Tag": [ { "name": "Agrius", "colour": "#D1B357", "exportable": true, "hide_tag": false }, { "name": "Apostle", "colour": "#97A270", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623706287, "uuid": "8cdfe3a1-933a-4568-b351-5febe013eecb", "comment": "Malware payload", "value": "19dbed996b1a814658bef433bad62b03e5c59c2bf2351b793d1a5d4a5216d27e", "object_relation": "sha256", "Tag": [ { "name": "Agrius", "colour": "#D1B357", "exportable": true, "hide_tag": false }, { "name": "Apostle", "colour": "#97A270", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623706287, "uuid": "fda3ec4e-0455-470c-9692-a0cc77aeff67", "comment": "Malware payload", "value": "be2dd26946bc0ca3ec8683568dc73a5852d79235", "object_relation": "sha1", "Tag": [ { "name": "Agrius", "colour": "#D1B357", "exportable": true, "hide_tag": false }, { "name": "Apostle", "colour": "#97A270", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623706287, "uuid": "7a9e6096-b08c-4bbb-b357-0dfcd67193a8", "comment": "Malware payload", "value": "5ef3ba01eeba50b3179b673252a250442a161dceefae8e3e8ffc2d417e4d0ad29bd1750499dfb770371118dd2bfb7436", "object_relation": "sha3-384", "Tag": [ { "name": "Agrius", "colour": "#D1B357", "exportable": true, "hide_tag": false }, { "name": "Apostle", "colour": "#97A270", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623706287, "uuid": "0929a79a-dc0f-4879-a526-e5dca621670a", "value": "D693F128B384CF66D5D90A7CACB395570338E24B0503FFAA9EC0A0A95F63FF453A1565", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623706287, "uuid": "be03a2af-40cc-471e-bcac-db04c41184d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623706287, "uuid": "10566ff6-1fd6-4c8d-86dc-2eb16a534a35", "value": "1536:rqW9dYMy7AEo67Af7c3wyFgyc8099vPMKkDHLVVLJUgWT8sCPL6vw160w/W:rqW9xO7Y7c3HFgR8GBMZDZVLKz8ewbw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623706287, "uuid": "30303b1e-8049-4258-89f8-0f7d871e5876", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623706287, "uuid": "8e9f2f34-ecea-4428-9d6f-307bc6b1531c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623706287, "uuid": "8e445479-e4a0-486f-a75f-d82f47a0c07f", "value": "19dbed996b1a814658bef433bad62b03e5c59c2bf2351b793d1a5d4a5216d27e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77160be5-ccde-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623654141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654141, "uuid": "1b760080-8abf-47f9-9c99-ab9b67428de1", "comment": "Malware payload (AgentTesla)", "value": "170539f67c91e15a531e327acc6f9e64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654141, "uuid": "d1704f2f-6f17-4543-9b30-170a863ab8da", "comment": "Malware payload (AgentTesla)", "value": "19fb6add81a24c5ec478728601bbb5d3159520e31b45e8586ad0d6cbb1f5228e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654141, "uuid": "5f237f43-a9b5-4d22-9376-d6a197056a9c", "comment": "Malware payload (AgentTesla)", "value": "ea416e25267f4af1c336afe5af0ea5ee2443dbc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654141, "uuid": "0a36ea3a-0005-4273-9e1b-236f9e10a2e0", "comment": "Malware payload (AgentTesla)", "value": "c4ddb0b3e1b45b378a5390771201c8049a406f49f6be75c354519f9b5e0238bc4287b79ec25369136c8ecb33fb78bd1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654141, "uuid": "8b5bfd45-3d99-47a8-930b-49ac43b50474", "value": "7275AD9063408750D42A87798C3796A25FB2AD0EDEE4CA0E3997BE8F3C71372512E55F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654141, "uuid": "2f72456f-fce6-4602-b94b-d5ce1ff5ec5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654141, "uuid": "b1f7f404-f97b-403a-9c73-d2e4c11d024f", "value": "49152:9XwBUwsEgwsxe5U/BldO3VGDwtSuYiAJ:KsEgwsN/BlU3VGvuYiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654141, "uuid": "449dd273-4b56-457c-84e3-f86c58db2407", "value": 1696256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654141, "uuid": "d070e993-feb1-420e-b353-9aaddcb26c97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654141, "uuid": "b9fcf88a-cbf7-4b1f-ad6f-c914a5bd319e", "value": "METRO- SPEC_3306_40B_LLC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c06e98-cca5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623629569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629569, "uuid": "b693743e-994b-4722-ac9a-9b41575b276b", "comment": "Malware payload", "value": "17ffeda7cf0f19381fb1eb0e70c03927", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsevirine", "colour": "#956459", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629569, "uuid": "9a367bf2-c6b2-455b-bfcf-8e5d34684fab", "comment": "Malware payload", "value": "1a9d78e5c255de239fb18b2cf47c4c2298f047073299c27fb54a0edf08a1d5a1", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsevirine", "colour": "#956459", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629569, "uuid": "af0f5a39-de6f-48c8-84ac-51997a2a2f0f", "comment": "Malware payload", "value": "43eec66f6d68f286357004dc62d6da01991a2eb8", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsevirine", "colour": "#956459", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629569, "uuid": "fc0bb744-0c9f-4355-8078-c9fddc1bd14f", "comment": "Malware payload", "value": "be6cc852fcbba66fefd94ffc5747d4156fe97645739a92fa6920d9feeac7875c9abd8fd1db309d65404d423f6ab31d7c", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsevirine", "colour": "#956459", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629569, "uuid": "a2e4395b-c847-45b3-82b5-a2422b5c5759", "value": "41253A2B6F5B85E5C036917E85A34606E3B1F4450B21FBD7C5D6722EBE37BE4083A620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629569, "uuid": "0d731b11-85c9-4a7f-99f7-f9e7eca32d1b", "value": "2d2aa79670bf41f8d9781b0220c1a399", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629569, "uuid": "99e68def-0eb4-40bb-96a2-dc0b700e1336", "value": "24576:3sal3QIVzVznbFijIVnk3r8RlvsNvBGP0dSGdnWfVwR5m:3salBzRUjIV68XspBGP0dSG0fq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629569, "uuid": "a78c8393-7d72-486e-a074-b76007ac3785", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629569, "uuid": "5c6d04d1-d9fc-4c6f-b004-1d20c27dfaee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629569, "uuid": "c252e0c6-c9e6-473f-b0b0-6f82ab0302b5", "value": "1a9d78e5c255de239fb18b2cf47c4c2298f047073299c27fb54a0edf08a1d5a1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c032146-ccde-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623654015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654015, "uuid": "9e3579bf-1c0a-4689-9202-7d56e7f734ec", "comment": "Malware payload (Formbook)", "value": "5884a0db03639f9b07c5c440d5f4f720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654015, "uuid": "294db613-48ae-4933-94e9-e7c61d99ca18", "comment": "Malware payload (Formbook)", "value": "1b0af3746922695a29974d6cf684f16c75050e3096422439ed241f2ffedce38e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654015, "uuid": "a9911eb3-87c2-488d-83b2-1973b8b8682f", "comment": "Malware payload (Formbook)", "value": "5fa3e2a7e4468c06630abd7a55aec795e65881e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654015, "uuid": "2e4efcc5-6e45-4830-bf76-bd14f6095c26", "comment": "Malware payload (Formbook)", "value": "72f64d1a2d030a0c74c6b68339c85d17527c10c4574624a760e40d31090649dcd30d4604df8c1db6c05ed330df3e11d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654015, "uuid": "384bfbe6-c4fc-4cbd-a7a0-1263010b3d58", "value": "13258CF8F59899B1C11DC772C7919CAEEBA111FE5303892D0AB9DA8C1F0378A8F5D845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654015, "uuid": "740e59ba-9e9b-407d-9acc-afd4e5df847d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654015, "uuid": "861ccad8-3dea-431d-8e2b-eb2a351a5537", "value": "24576:rj28bH4TY7sqPiLgt+ISZHMUzx34OROMds:zmY7sqPZt+LHlzx34ORds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654015, "uuid": "574ab84a-77b2-4d5e-9382-08e2f2d1346a", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654015, "uuid": "f7114121-8363-4869-8578-389e318915d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654015, "uuid": "b410a625-5012-466f-bee9-a5aade8d253b", "value": "Shipping Doc578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be90f57-cd1b-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623680349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680349, "uuid": "13f8d579-123a-40bd-88d9-07e166ec568f", "comment": "Malware payload (Quakbot)", "value": "1852e9d64deb9139a8a061fe7c213e03", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680349, "uuid": "47cc8e9c-dea2-4d9c-ac7f-82fcf5609451", "comment": "Malware payload (Quakbot)", "value": "1b217718aa4d9aebe7bd7fa5827c544a6f75ee742ad286a5b82efd395685ef0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680349, "uuid": "aaed2317-6231-42eb-8035-ea372777fdea", "comment": "Malware payload (Quakbot)", "value": "6148bef70174b3ec3f6db76ee2d9ecb2c4d0e8f6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680349, "uuid": "806b99bb-689d-47fd-b7fe-4297b6b81372", "comment": "Malware payload (Quakbot)", "value": "5a2c95daaa3df640498dc8f23e0ef825d606a4e2e548c79150b762dd0b08fbfb63173f88adcf93bf8d5749354ceb1f4d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680349, "uuid": "56d94ba6-4545-4bd5-9cdf-932c22734708", "value": "A874127EE68169F8C3398D3EC640A1D48215E1D140A7B71D06DC391CAB533DBEB9E2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680349, "uuid": "0a4d0255-e32e-4754-949e-0a469f61d61f", "value": "6144:MRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNa:MRMmEv2Bc/nvm8IKABfsYOmauFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623680349, "uuid": "29c6741f-2a74-4a55-9b51-34aa3802727d", "value": 351561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623680349, "uuid": "23011f56-4810-480d-bfb9-34c32332c8be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680349, "uuid": "2e12bed1-685f-4931-abe6-0ed5c5a5aac3", "value": "Rebate_1355614480_06142021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc22d641-cd3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623695945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695945, "uuid": "e5f5e085-89b5-4e29-b251-71efd1aa2ba5", "comment": "Malware payload", "value": "976fcb547c231838ef30687d383f4153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows Spy", "colour": "#3985F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695945, "uuid": "196f3bf5-658e-4002-920e-bea50bb30eec", "comment": "Malware payload", "value": "1bd7f695ac2b3267dcc36f68784d44ccb966cee16c88db57ad004995527dd6ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows Spy", "colour": "#3985F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695945, "uuid": "2fd26352-80c6-45c7-a9fe-b550e4ac1999", "comment": "Malware payload", "value": "0aa898ffd5e2c560294af6838b03f840b72c29df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows Spy", "colour": "#3985F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695945, "uuid": "24445b5e-fde6-4285-a922-f147537d6ebb", "comment": "Malware payload", "value": "6b9e7f16c483de85f01c867ab4ab221a01c501b211ec9b7d3a66ce268d93e3a50de4332dc459d2b79e9304a757ad8947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows Spy", "colour": "#3985F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695945, "uuid": "12d10e99-dffa-42d6-9247-72b28d697318", "value": "196618C0E99B74F5EA024D305C9BA26F53306A078F35CAC7C6406E76EB376DE092651E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695945, "uuid": "6096d0e8-8471-4454-b6ea-3b3c3acf3fd0", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695945, "uuid": "372b1939-ce3f-4417-9028-ed7e0d5ab385", "value": "49152:/JdDgX7FK8GwWQTwxeM8avvm1afzY0TER9YwlLgT8zcXpvQcA2eCoo3LOJVPCObe:hPnykvvCafzY0jwlsKcyyCe8jxAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623695945, "uuid": "1fee1524-d8cb-43de-a2bc-c4659de4f414", "value": 7002624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623695945, "uuid": "33a2bf0c-6985-45a4-b412-73ae498712fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695945, "uuid": "4b8ca140-f3b1-4f3f-b177-2f7eab1ae935", "value": "WindowsSpyBlocker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f87cff-ccc5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623643560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643560, "uuid": "187e2df4-f8ce-4ef7-98b2-2df5fbd42547", "comment": "Malware payload", "value": "043662a4b5e44eb83cec615f2a519906", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643560, "uuid": "0779a0df-6ade-46d5-9ec7-35f01df9a1cf", "comment": "Malware payload", "value": "1cded2a6ad0ce1864580e179b9ddd2a5eec787e96236bc8eb0cdb61ce47a137c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643560, "uuid": "f6cd052a-346c-420f-9209-b7a01163f060", "comment": "Malware payload", "value": "a3445fe53782b10e5903e41ca8af89faac192df4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643560, "uuid": "c20df4eb-7a8d-41c7-a201-39731d9a4709", "comment": "Malware payload", "value": "e1495e9167a1cfdb453463f34ee740fb60343dae54077ad44ea182ef26227962e203a2cdd6d7e90f92407cef1f362211", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643560, "uuid": "e8dd17ea-e91b-4f33-a6f4-2ed85fa36d57", "value": "C306F1207E82C132E56281716D7DAF6A54BCBB750B7581DBA3C80E2E0D705C36B3A75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643560, "uuid": "fdd653ba-1d69-4102-a5c3-3c3e0ae03fea", "value": "d9c9b2207194e3b00f67e3fec7ad5f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643560, "uuid": "e32d23ae-c24c-49c9-9692-19b4f54139c2", "value": "98304:e1wpL+yII5n5PIdtsnZ3BxtBQzjumyCzEpq/:Ow4g95PIP2PQuZQz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623643560, "uuid": "9d77e603-1707-4271-a243-60b85e2a9f3d", "value": 3826088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623643560, "uuid": "bc8363e3-105c-47e6-aa20-372a46a8dc1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643560, "uuid": "212c5171-b712-44d0-9f80-8a6fc5210c86", "value": "043662a4b5e44eb83cec615f2a519906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf52d62-cd01-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623669157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669157, "uuid": "004e9621-06ba-433c-88ad-b793cb1dc266", "comment": "Malware payload (AgentTesla)", "value": "d745ed2bf61c2165297ad6c0106398d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669157, "uuid": "eed65333-a539-40b3-92c9-99106907c244", "comment": "Malware payload (AgentTesla)", "value": "1cff6ac43c1bd21886487da201d509090058fdc1b584b064c13e65efc4c376ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669157, "uuid": "7827e210-ba52-4d64-8fb2-a72f4bd9907d", "comment": "Malware payload (AgentTesla)", "value": "5f13e42c96cbad6788f8150749e005439e6543c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669157, "uuid": "de803d8d-392f-4c06-b90f-e99e8df153f7", "comment": "Malware payload (AgentTesla)", "value": "5ab2fcaa82ef693a3805e22da0b644a63f8a61fdd098ede6f50ef58eda1f40754c7c004c0c3894a3105568adb715ff32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669157, "uuid": "b02e5ba7-49c8-4494-9c2d-4ee276882383", "value": "10D40482A8D00756D42E657AE8EC78F552DDF92E6804EDCF10F0E75A913734FCA8B528", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669157, "uuid": "af5b8e41-292e-4cfa-bb62-40dd99fc1af2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669157, "uuid": "e5adf589-02f2-4475-85e1-5bc7e9e128e5", "value": "12288:FZQAI9zxj9WBzav++6GDV9cTNv0BCnndVYUAtH:0VNsX+VV9GNMBmnvYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623669157, "uuid": "7b2c44ca-adec-4385-bd1d-65d3e9075298", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623669157, "uuid": "3df08a64-d5e1-4128-af61-4dc1e218e1da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669157, "uuid": "fb9b0231-359c-454a-944b-0952355ab847", "value": "FARMA QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458096a2-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623654488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654488, "uuid": "097a2834-d5e3-4dd8-b17b-358299bb0a7d", "comment": "Malware payload (AgentTesla)", "value": "b30ee4898e8b728051cba76a6511db8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654488, "uuid": "b4d0e1ef-35c3-4c17-ae02-03647e61ddb1", "comment": "Malware payload (AgentTesla)", "value": "1d199617379a801e0dc4f1f88a601c465373c0add135424dac41825162f4aff1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654488, "uuid": "be676d6b-1387-4761-9c23-8d87ed0dbf7a", "comment": "Malware payload (AgentTesla)", "value": "194893fd9d7c9791db9287e6917007ba1631db11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654488, "uuid": "0814c4cc-9056-40f1-89da-03145d844285", "comment": "Malware payload (AgentTesla)", "value": "7e33515b87a982301b4ca9bea16ecc7aae17751531e265a6050452f4e31ed0e36d82827e86c9452a7e26257c4640474e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654488, "uuid": "51a81ceb-6fb0-44d1-9b0c-07fcbf8074b1", "value": "2605F1AC721076EEC86BC075CAA81C68EA647C77571F4207941375AEEE7E987CF140B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654488, "uuid": "df4014cd-dd7a-4951-9458-b0ee9170c725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654488, "uuid": "9f25e56c-90ec-4001-8a58-e022d8873281", "value": "24576:8NeBUdtPYVrUAX7jr7YiWYyWIEsAecWX:8wBUsomIEv4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654488, "uuid": "ac6cfb29-6c40-41e0-9112-a7e64fc0660c", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654488, "uuid": "2551a099-21ea-467d-b620-462d3f4d5df5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654488, "uuid": "19eebc2a-0dbf-439b-81be-7b6740f6c855", "value": "b30ee4898e8b728051cba76a6511db8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456255f1-ccc5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623643320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643320, "uuid": "77ce0b2c-8954-42d8-8838-d929dc7ab2fd", "comment": "Malware payload", "value": "d9ab3d4d245f15f7b2ef8fcff17d5a1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643320, "uuid": "e5c5dee6-f608-4f8d-9e20-cda9c701b8cc", "comment": "Malware payload", "value": "1e0f77de2857552ef071bc864c9802aa10e48b8d4d4c5e19b3a5572bf4b5ec18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643320, "uuid": "318577f2-1417-44cf-bb39-aceaa168b570", "comment": "Malware payload", "value": "a264b39c345c067715020e9dba04e83a87a80d49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643320, "uuid": "a9555f4a-e9ae-4092-af01-d13dcfd21f79", "comment": "Malware payload", "value": "019d295e4e2307f88f198a7cfbd88e62482569a2c77e0e096b0181e38bcca99f8d7ac59d088e2076e8c55bd5a1483eac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643320, "uuid": "acdb1cdd-14da-474e-8c0e-45df55c8f6b0", "value": "9606F1207E82C132E57281706D7DAB6A54F8BB750B7681DBA3C81E2E0D705C35B3A75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643320, "uuid": "38c8d3ad-895a-4c79-862a-b0bce6902046", "value": "d9c9b2207194e3b00f67e3fec7ad5f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643320, "uuid": "d0fedde6-0e49-4678-b292-cc45776c96f5", "value": "49152:/fRt1woSNB+NauD2hIXwT1VPXB5n5PUR4uC1wOP1j6k+tQfbmWC/AYjacI4Bw40C:/1wpL+sII5n5PLdP1ukEQzjumyCzEpqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623643320, "uuid": "2877c793-e8f9-4520-ab3e-91a2d8d41919", "value": 3713960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623643320, "uuid": "1bbacef9-7672-4a70-ad9a-4a3c0c483dc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643320, "uuid": "961338d0-b51b-4c71-a4d5-f378f1976ca2", "value": "d9ab3d4d245f15f7b2ef8fcff17d5a1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b67d88d-cd24-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623684267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684267, "uuid": "72114bcb-e5cf-427b-a1ba-f02f871d5eee", "comment": "Malware payload (Quakbot)", "value": "0df7b8c34f16b88c4d48aa210fa2a2c2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684267, "uuid": "29b37275-d91f-4ff0-b71d-5ffbd74ab692", "comment": "Malware payload (Quakbot)", "value": "1e3162287dd50fd4d3b3f677b460b0dbef37f1cc19aa838214b48d0add8bd98d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684267, "uuid": "86422385-eb00-4774-b6fd-a07abbccc4b2", "comment": "Malware payload (Quakbot)", "value": "ff6d7eb964608bcd6672f321b3d1369fce12eeb8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684267, "uuid": "3887c07c-82ac-4d01-92e9-022d2a073c4a", "comment": "Malware payload (Quakbot)", "value": "319a269c4c49ce7674f6656dbb4ea3c3ae43033431add15515e7757aa27f6c91554727cc361446940fd3b0bbd8508932", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684267, "uuid": "e2e79171-2672-4c40-92e9-d39058c721c5", "value": "DE35BE41B585F836C12519395F84F6E50B6CBC244F69268F37C91FAF6B3D2830A2936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684267, "uuid": "9e1a1a91-b04b-4406-8106-98cad87fed84", "value": "6e1334af14515d2fae56a542c908133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684267, "uuid": "b475689a-93c5-4d0a-91c3-695a8c769cf8", "value": "24576:mDc3ZBXFdNMf6ndhFe3KYNdcyI5i7m0EEOy4TF+E:mkdKf6ndhQRzI5iAEOBF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623684267, "uuid": "8f4c4fef-8103-493c-a01a-0591699cd8b0", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623684267, "uuid": "1c42ca88-bde5-4115-8934-02f5b3ef5d5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684267, "uuid": "1ecedeca-63f5-4176-8c35-dc2d704ea41b", "value": "0df7b8c34f16b88c4d48aa210fa2a2c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce255db8-cd52-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623704109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623704109, "uuid": "d9db421c-c53c-4d76-a97f-e78336c971f2", "comment": "Malware payload", "value": "a43cd48f398a3e6b64f0c038d4ed3efb", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AVevasion", "colour": "#474AFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623704109, "uuid": "b0205dcb-6bb8-4b7c-8ee1-1393cf27c7d2", "comment": "Malware payload", "value": "1e91735f8f9419790ccf0ab4776075980d9fa7c2bf514b9f99ba73e3d9f40f73", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AVevasion", "colour": "#474AFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623704109, "uuid": "3cecfb16-847a-4b8b-9508-113339201f28", "comment": "Malware payload", "value": "45c628c283760b74ec1d116dc7107243fcec5404", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AVevasion", "colour": "#474AFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623704109, "uuid": "e8cdaeb6-c8a9-470c-a105-18f522e5f031", "comment": "Malware payload", "value": "4e530f0ba0ac06c534f55c6f03d1cacfe05a995e4a326d51ab8a7c2b761b9442dbfc7cdae6c21c52bf59f066a58baeff", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AVevasion", "colour": "#474AFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623704109, "uuid": "3aaf2271-1018-4de1-bb49-210580cbc46b", "value": "0EA36C3857AD9732DBFF0BFA49A393508B71C5A2B623E7692EC050D40F237996B11253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623704109, "uuid": "629571e8-ea3a-48c8-ad74-b0090a7d1a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623704109, "uuid": "cd0d299c-0cd6-4aad-b9ae-631b54013f02", "value": "1536:SPQkH0rCKLsrMKi/IXkzgWUT3pZVjLn89fONb61954fayQF:GQkH0rCKLsQKiUkTUT5DCfOx6mfafF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623704109, "uuid": "ebca8deb-4faa-4053-8c8f-90a72b9c4df5", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623704109, "uuid": "c3afb67e-d26d-4511-8093-89748bab4a7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623704109, "uuid": "752373e7-0e6a-454a-a5e4-8c81766c22db", "value": "agMvVrqQW7a4xXqP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55b7dfe-cd05-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623671077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671077, "uuid": "ea9ded0c-79de-401a-a735-496c4cc4be29", "comment": "Malware payload (Loki)", "value": "ce8d2caffc10cc0ae5f8fbe48f4a7e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671077, "uuid": "501e1e9c-7d50-42a8-940c-54377ffbfaf3", "comment": "Malware payload (Loki)", "value": "1eb22488631a731f6fc27ad209f386b8b0aa6181016badff86ee36bc2e42a256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671077, "uuid": "9855f63a-e990-4b55-8a05-e367273ff89e", "comment": "Malware payload (Loki)", "value": "79be08854e9358466dc202b0a0d0980216427113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671077, "uuid": "1ebe3eb9-6a4c-4c88-94ca-a320c85bc999", "comment": "Malware payload (Loki)", "value": "e39bc72709f040a5f74f47c38b2988bc3431d2be4835147c67d66fd10dce8c5fe61bf1545595ec13dbf89116c6704623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671077, "uuid": "3d354b1f-6e49-447f-a800-aa0a7ff2087a", "value": "B735C012B255C95AD43E89344472D1FC05F1EF8E6B29FA4B3DC0B96F6DB2384C962B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671077, "uuid": "59cdc017-0ae6-4a57-a861-cfb9c8c9b3bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671077, "uuid": "2d1d4d6f-1dd2-44b7-9d11-b8710f3728fb", "value": "12288:n0KFry+lpd1YyD6IviP4oujYHcIozQseugU7SHhV9PPHnnMkPsmd9VCZ6vP:HFO+lpb6YMKzQsYUMhVhHnMkPLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671077, "uuid": "e5a5339f-431f-4b1f-9109-9eed293f6006", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671077, "uuid": "e6512991-4e6b-433f-9694-10ee4eb15472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671077, "uuid": "50249f70-acd8-4715-84f0-cc21ef82f59c", "value": "Proforma_Valid_Prices_Order no.0193884_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d733aa-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623653622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653622, "uuid": "404dc30b-0352-4032-aeb7-acb9f8bea5f5", "comment": "Malware payload (AgentTesla)", "value": "b318c7a82e95033d6ff723d8b9fdd27c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653622, "uuid": "fecea474-650f-4376-b8ce-25a018f05679", "comment": "Malware payload (AgentTesla)", "value": "1f98a0298834c6120bc6338d07c08fd4b6999c839c7c6fd7dc7777c2bfe4daaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653622, "uuid": "93cc50d0-dce9-45c8-8d9c-330ec6ed02da", "comment": "Malware payload (AgentTesla)", "value": "884264194bb466de567ee0417f2b033c0ffdb963", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653622, "uuid": "2f7b1f4c-6936-4b45-aaa7-91afb4bac164", "comment": "Malware payload (AgentTesla)", "value": "62ce7d63c5cb4ca4cf20e279c5617192d2f45d1e352c4826d5a36693d1b185ade65046b3380a8d2dda451284e36f36c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653622, "uuid": "01229aae-76b3-4933-aeba-76ed0bb82bdc", "value": "37D4E025F2A48BCAE0185FB74724D5010B753C53B924C62D686632FB45F2BA31A6BF73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653622, "uuid": "187d281e-73c3-42c6-a62a-a99b022c267d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653622, "uuid": "c21e4224-bf41-483d-b0f1-24fb66e40ab8", "value": "12288:8OmCs8/1E9witJeCy321wSX0du+nw2gFxfNRdtLfFge:EXm29wiT621deu+nwX7dZfFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653622, "uuid": "848cfd08-066f-4fc2-82ae-75bb372f922a", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653622, "uuid": "24a87af7-320a-406b-9af6-01fc04fe9b07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653622, "uuid": "301bee08-ff57-4edb-84de-4547356b405c", "value": "Hesap hareketleri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9c4424-ccd5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623650396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650396, "uuid": "d9287981-5d5c-4172-a4fb-abc55840fa90", "comment": "Malware payload (AgentTesla)", "value": "48deaf2a701355e45b58cf9a8abdb554", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650396, "uuid": "62e6e34a-51a7-4378-9de0-558400ddce23", "comment": "Malware payload (AgentTesla)", "value": "2000e27438870963530d3a5ca8b0be9be30113c0d14b813753760ac10c02fe10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650396, "uuid": "9e045d90-7184-44ce-ae1f-4e51bf2e6ba1", "comment": "Malware payload (AgentTesla)", "value": "09775766811484aa97062a6f5e3e2ab86697052e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650396, "uuid": "62c366b0-ea19-4fbd-9817-1084765d38fe", "comment": "Malware payload (AgentTesla)", "value": "ae93d515a785449939a71e818a2c64b944d7c7958c0b33c4532fb36c4ddfb7b1b093ecc811251e97bffb4445d80f6d54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650396, "uuid": "da67be64-1864-49eb-894c-abc84551e09e", "value": "6315F69C366071DEC867CD72DAA82C64EA61347B931FC207901315ED9A0DA9BDF246F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650396, "uuid": "b42a6283-835e-4502-9c19-b81929cae9aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650396, "uuid": "3b820095-d010-43ed-a4db-97d63e8e5fcc", "value": "12288:rIc7vawAoV/+NoFLMtgmPdKy1GiP1n1loi4dHcDSr+cJln+xI/EpFmRMINAsXvOX:r7Z/FYiSbN1rozHDrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650396, "uuid": "b1099799-cb55-4f9d-b61f-7000bae6012d", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650396, "uuid": "b7a6b0fa-6fa5-4c35-8024-f111578aabdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650396, "uuid": "8973c700-c655-4c72-a6bc-fcade6a757c3", "value": "RFQ 3546575432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8648eff6-cce2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623655885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655885, "uuid": "a715c885-da58-468f-9a5a-75b7f14f06ba", "comment": "Malware payload (Formbook)", "value": "b1f8aca2f6dde172735098c97e1b84e8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655885, "uuid": "b2306d46-1ede-455a-8726-6b0b66ed84cc", "comment": "Malware payload (Formbook)", "value": "2023b69415827a06a80ccab79bbb7b6447cd3d5873b5faa2231397f59c1ea3f4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655885, "uuid": "a3b7f4f2-4566-4d91-beb2-b3d61f91bad7", "comment": "Malware payload (Formbook)", "value": "8a0757105a9354585f94b484039b2f9f5602bf65", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655885, "uuid": "95f62329-93e5-49e7-b633-66dc819cc5df", "comment": "Malware payload (Formbook)", "value": "7810c689bbfe19b4b99e30c9c7466ccf90ce895574b565ce8e51e69c07de2c2d9c836c904db329ead10e3656558856c3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655885, "uuid": "55d92bb1-17cf-422d-aa8a-fbb749f2443c", "value": "C765AC0CA0BB5A42D3CBD5E0B6AFB70C566DB84D21C804594825C5ED7CE4CE9C7A9CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655885, "uuid": "2a938d0e-8a1b-4497-a419-e6268995d195", "value": "1536:7w4Gt4KcRRRRRRRRRyvRRDRAWwcs2QodjRANl642XlAWwcs2QodjRRRsRBRRRANk:ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623655885, "uuid": "98fc7802-190f-428a-aa9d-73a5c113d080", "value": 1458207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623655885, "uuid": "bf4eb7a0-7eee-4919-9ebb-2a2770c77ab9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655885, "uuid": "034183bd-02b7-41a5-a53e-b70a158b85d4", "value": "RFQ-Excel-NPF0140621.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e866948d-cd29-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623686544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623686544, "uuid": "90cd3f4e-8247-479d-894c-498ecf1b622c", "comment": "Malware payload (Mirai)", "value": "c546c84e7986287a43ebea3505a7d40f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623686544, "uuid": "b40b062f-a17c-4eb0-946d-402558088c28", "comment": "Malware payload (Mirai)", "value": "203693e974eef6b0042641cc68cca584cb533d3dbf37a5da0724750a64a2bba8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623686544, "uuid": "88757071-b5ca-47fe-8616-7af037738cbd", "comment": "Malware payload (Mirai)", "value": "554775f75620f0cc7a4da31d765cf41471a21939", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623686544, "uuid": "4c54be80-3aba-4ee2-a8c9-4071b5822336", "comment": "Malware payload (Mirai)", "value": "d93bcbc460da307216fb43e44f23b80cfc26fbaff34e545127c4e9c461b160e3fad655d453ae484f5b3bdf794e34475a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623686544, "uuid": "e4a653c9-1561-4ddc-aa52-c78616da2d4e", "value": "C2830845BC818A62CAD422FBFA6E118D332263F8D1EF7207DD146F6437CA82E1D66651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623686544, "uuid": "23cc4e85-38bd-4396-9ce6-cf3e3a6bd328", "value": "1536:fM8GL8bGMNbXOzU/6IwNzLAu5hXyGl4OywXTjbNkLt5lceRt58OxaT5ie:fMfL8bOqu2GPyujbNiblcAtkTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623686544, "uuid": "ebe12ce6-dea2-44ec-8679-eaaf295f6137", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623686544, "uuid": "21e9b2aa-ab45-4b5e-a6be-4f7c805bd841", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623686544, "uuid": "d05ebd02-bc88-4650-a752-a2fc8895026e", "value": "boss.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8a6d8b-cce3-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1623656112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656112, "uuid": "b4cbb93d-2614-48aa-8a75-1d5debc72191", "comment": "Malware payload (CoinMiner.XMRig)", "value": "1747130e2a624bf1b4296d755a04bf98", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656112, "uuid": "9ecd80e2-1060-4c0c-808a-3139cb0ab3a9", "comment": "Malware payload (CoinMiner.XMRig)", "value": "20eecb6687aa0ee75d09ae126be8dfb849789c7dcd4dac94e0c07ab2188fbdcc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656112, "uuid": "402661e8-25dd-4463-82e6-92fd06289cde", "comment": "Malware payload (CoinMiner.XMRig)", "value": "88f182e4f3c21f518245285026b8d9469dc4aa7a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656112, "uuid": "4f0aa66f-472c-48f5-9d84-5ddebe3cd944", "comment": "Malware payload (CoinMiner.XMRig)", "value": "2a38b5008891bfb7ced59b4c46cc3b09f6717c01a719230e5ccabaa4901d2ee2ac90c8f2e5a005320a68f8dee2715ebc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623656112, "uuid": "d9914b2b-30ec-4eaa-9f9e-73640ae431d7", "value": "25963353B4458FA7C5AF65B3BC7B203012645FC68695824E296B332564933F328AFF4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623656112, "uuid": "c3d15ab3-ee67-4437-82e9-9c650dddf816", "value": "196608:IrfeYNrjfEecBu6C1ngyiqwRTughsSoJha9owVdG/TXIBn7EqUG0:undgnBu6C6euughKXWe/7E4qUG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623656112, "uuid": "422debe6-289b-4229-a9bb-421e90cebd44", "value": 8926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623656112, "uuid": "52a1f9bf-12c3-43be-9edb-1b2c7073ecc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623656112, "uuid": "7217b6d3-8e34-4605-b499-bfdecbe18146", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a840acf8-ccd8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623651647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651647, "uuid": "8d890a59-e318-46d3-853d-8b22db5fc2a7", "comment": "Malware payload", "value": "c084c1c7b16e57b4a98a59e17c4e786a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651647, "uuid": "f34a3e0d-938a-4cb3-ac9d-f5d01d5b1719", "comment": "Malware payload", "value": "20fe5a152878e31a0bab6102a8c265f8e4e0309a4cbd1d03cba00ddb22bc1633", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651647, "uuid": "b47d2351-76ac-4948-8781-3310764bd413", "comment": "Malware payload", "value": "d95f94945b9d5cf40b707aaab5abad5ad33c86ed", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651647, "uuid": "d05bf59f-53dd-44ba-8dab-146f112a4231", "comment": "Malware payload", "value": "71416f055465fc437c456e7a757e7469b2bc9c16da46bb47579468c6ad4d3ad56d236afde9877a160688f7eb7fe61896", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651647, "uuid": "90fa5feb-983b-41ba-b6e4-ffadd3a5e7a8", "value": "11553344CD84CB4AD626C5B8C40BFA909486CC45269BD3D763BEB52ABF337F4118276E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651647, "uuid": "02b442c7-aa7c-4b04-8563-d13b4ee75508", "value": "24576:KnN7rinmnNISnpkbzh69ZcQkLMrFWaG2bTsqnF2k60ne8jj9Stx7ccwkg:KnN7enmNXuh63iMr0f2b4OQkdLQIc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651647, "uuid": "d6d776e3-5801-48e4-af33-174bb2c35c31", "value": 1393241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651647, "uuid": "b6d45693-46d0-4453-b50f-6d78e8fd0467", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651647, "uuid": "4eba5b0e-6077-4bb9-aa5c-644368090f43", "value": "KYC Compliance 10031.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacd9903-cd3e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623695460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695460, "uuid": "a18f0d8e-ae2a-4c2a-be41-dd5d093ec37c", "comment": "Malware payload (Formbook)", "value": "d9c9065ae8afa37e963b10298b7df056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695460, "uuid": "5bd5b6b0-bbcb-431c-9c1e-feb019db47f6", "comment": "Malware payload (Formbook)", "value": "22ae731061f7359c7467be0f7a710013516ed356a79b2e23adec7c57a12624a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695460, "uuid": "46904038-7617-47a7-8a49-323cf1d531b1", "comment": "Malware payload (Formbook)", "value": "0db2e4a372e3302d1c32f0a58c8351055a0a190c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695460, "uuid": "64634681-8805-43c1-8779-03d67f603780", "comment": "Malware payload (Formbook)", "value": "297eaefc1a9e9ed5809ae3b140f95e3cf634d294f46e7ca59208bc48f8474d1392e60c6fd46ad350494ce874944636b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695460, "uuid": "53352a03-ca12-49cc-b457-4533744442a1", "value": "7014122B7AD5E977D5262A312D57DBD4EF7BE7460360082B5B249EAFBA521C3C0180C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695460, "uuid": "01d5318a-5c37-4451-b3a8-053549d460e1", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695460, "uuid": "5e1fc64a-b98f-4064-9aa0-15199fe458ee", "value": "6144:Ds9ezCDRGrBZlssvgMQwF+AVqEpI6BUvhXF:yezCDRuBZlsxeFMEqhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623695460, "uuid": "8abff777-14dc-48db-b164-58d01f813516", "value": 204934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623695460, "uuid": "c85b5611-b6a3-471c-844d-e6d4683e7d7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695460, "uuid": "be6a874f-6e37-4c7a-a575-e62554432c06", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06f4b9f-cccc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623646480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646480, "uuid": "32bad235-402a-47ec-9fa3-28589b60d21b", "comment": "Malware payload (AgentTesla)", "value": "c6e05730d127dd63cee99d3de5724fe3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646480, "uuid": "cc1eff64-5db7-46f6-b5fa-9c233d27fdd9", "comment": "Malware payload (AgentTesla)", "value": "22ebbc53875428f02e57f12bac248508e2240bd4a9969832e1fa709e2f42f7aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646480, "uuid": "b3b37188-9bbe-4140-91ad-e7d30c76c7ec", "comment": "Malware payload (AgentTesla)", "value": "be9118c555cecbc4ed0cb8514f9b8013a69e45f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646480, "uuid": "b86aba93-cccf-4de0-8acd-2eaadc11b0a6", "comment": "Malware payload (AgentTesla)", "value": "a9f88ec8c0a6f7a3201155479ace70a1f1dd384eb2469434b702d4c6f1ace8cf19670ea93bea539f339db27da2b4e3bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646480, "uuid": "627fc91a-c71d-486d-9aeb-04b4bddf931d", "value": "4105F1AC715076EFC86BC175CEA45C60EA607CB7931B5217902331ADA97EA83CF590F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646480, "uuid": "0dccbf23-ba08-4c73-83f6-a9c4a9137cb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646480, "uuid": "0b8cce53-1046-4af2-85f3-f6f6ef3ed954", "value": "24576:aNeBUdtT1z+9bXhf8LKDqwS/VCt0EV4Kpqpo1APsqH:awBUpz+9lkLKDVS/cygrXiPZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623646480, "uuid": "feda00b7-1c8b-4b0c-880b-513beaf4c8cb", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623646480, "uuid": "0a01b1fc-762b-450e-a30d-d9d105ff08ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646480, "uuid": "8d372b68-4bb0-4b7c-b864-4b6f23d47649", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d24b16-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623652121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652121, "uuid": "9ac37b9f-aa08-464f-9b86-9a0642384ae2", "comment": "Malware payload (Gafgyt)", "value": "8d985aad310656742351ac981658ad71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652121, "uuid": "d1774436-535d-4d72-ba05-73fb6dc4bd00", "comment": "Malware payload (Gafgyt)", "value": "241d8dc6b692c6c05e5b83ba80b4a02314c068b6b7c5dd9d3d00fb15a10c906d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652121, "uuid": "fbcd2e43-5abb-4b73-9402-7c12d7eff87e", "comment": "Malware payload (Gafgyt)", "value": "61ec41dfc237a80c70fed1b576316642e93821b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652121, "uuid": "559266e5-a6fc-408c-a838-769c3da9da5b", "comment": "Malware payload (Gafgyt)", "value": "9401060d3d48add1d898e9c419f4d49c5dbb60be5a562c2345cb0a8c004a9128a78baafbf9679776313545fd29187287", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652121, "uuid": "47991be5-3673-4298-ba0f-bb8928d2bac3", "value": "FDA35B82D642C2F3C4430AF1029F965A0532FB3A8E3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652121, "uuid": "65277e5d-b8dc-4be0-bb0a-fd41571711d4", "value": "3072:4PaqjPQP39VjGWX98732V7kGyNVz5heTz7FXnf0OzTyoQQub:4hQP39VjGWXW9NVz5h+XFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652121, "uuid": "8977d9e6-d859-4c15-86a6-1ccdbb6bc1a7", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652121, "uuid": "5eea3348-ec38-4310-93e3-d0ce782b4042", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652121, "uuid": "0e7b6998-3cc6-4f6f-8141-337fe1309171", "value": "8d985aad310656742351ac981658ad71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066752ca-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623653523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653523, "uuid": "8393e66a-49e0-4846-9e37-b7ba742e8148", "comment": "Malware payload (Formbook)", "value": "ac72e8a3da3e0d0137f021ffa27c588b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653523, "uuid": "ddcbdef3-caa9-4400-9918-beb9dd942438", "comment": "Malware payload (Formbook)", "value": "265b7bddaf31285b3646790c12985ddd0bb30bbde91dc363ff59c22302e3b39b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653523, "uuid": "1d38f76d-f9eb-4cf6-87d3-bab2aace1095", "comment": "Malware payload (Formbook)", "value": "e55f621c6cc8b6c6da56503994d5e2057606780f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653523, "uuid": "94fef8ec-65cc-4af8-bea5-d55d1cd8131c", "comment": "Malware payload (Formbook)", "value": "2f15a33c88a531a7e1bd0b9ad24fdefd67544c1f015a9e039771b3c97866f9865e463367571d0bab26268fbe0b58545d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653523, "uuid": "558a7186-1d90-47a0-8216-abda214e0218", "value": "1BE4AD9FF36296DDECC85E72D62085C10B6428C2641581289CDF719AC8F16F3277AA7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653523, "uuid": "5c336f75-97f5-4b96-bef0-8535af7b78d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653523, "uuid": "6fc07a57-2ea0-4c98-8796-b7184b4fc1d1", "value": "12288:yzIm2MSOA+S8xfnDvUPd8tzrZKV/ntKfSxQ6kiZBUxUo618rdbFgeh:IU+5RvUPKtzr0hntKfzpiify81Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653523, "uuid": "f435b34e-d3e2-4ed0-9385-2b584d6f5d60", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653523, "uuid": "8b97d88f-0b46-4a15-90fd-5a7a4654447a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653523, "uuid": "f63cf472-2a94-437e-9147-34e62f5ff420", "value": "RFQ-21-QAI-OPS-0067 (7000000061).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb4e67a-cccc-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623646635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646635, "uuid": "643a1e6e-2458-4334-9da6-b5fbf1806df5", "comment": "Malware payload (SnakeKeylogger)", "value": "cd0e40e6a3c9bfdc257cb005eea3fddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646635, "uuid": "e8523e96-2182-4733-b820-7e4e426a211b", "comment": "Malware payload (SnakeKeylogger)", "value": "278ef95cc2b28d5e65b96e03aa6121e013e9f9121966e7340a937518d20a407a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646635, "uuid": "2c78a3d2-da92-497d-8007-8866726e84c9", "comment": "Malware payload (SnakeKeylogger)", "value": "0fc69697652642488e658ea0c5c98f24c885da85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646635, "uuid": "562afce5-97a7-44ed-92df-bc6875d9ce23", "comment": "Malware payload (SnakeKeylogger)", "value": "ed5a346589e70275f266daeac812ee2289765491b8dbb8f67a463482c1dca1c4be3c28fc89a97014a531eec66915a618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646635, "uuid": "5c2150a4-9fbf-4d23-901c-c3d76ee8fba4", "value": "D4C4125B769C576EE39A8AF1713C42708769EF932310B846FBC9FE2D117114EA9032C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646635, "uuid": "ff59ed99-8d15-4baf-ab98-af74e2be72c3", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646635, "uuid": "cf657a2d-1b24-4697-87fd-37fec45bc54c", "value": "12288:36lnmFeaxWpL+oK88CRs1Vm8HDD9Rzduk7B2iD3tN8O/dUt:36VmMaxU6oJkG8jpRs9ytNnWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623646635, "uuid": "cebab4eb-7096-4083-b6ef-bfad73bc27b8", "value": 596276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623646635, "uuid": "ea17e8ad-b79c-43ec-8ecc-c0532a0cfe1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646635, "uuid": "21a816f3-403a-479c-a068-066bb7d76c80", "value": "INV 8462924546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae98e3b-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623654631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654631, "uuid": "a1899a76-8875-4ca7-8046-959c7085b2a6", "comment": "Malware payload (Formbook)", "value": "d1281d942880ed78daa515e080f52e6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654631, "uuid": "457c5689-8db9-4415-a10d-71d188c3d555", "comment": "Malware payload (Formbook)", "value": "27ac793d4f3caf8cae1ead8e5c30e88a7d7d1c13ab5f8ce929dfb65f8fc02011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654631, "uuid": "2a9502fb-cd77-4ce2-9de9-751a371273b7", "comment": "Malware payload (Formbook)", "value": "5519c8c565b682f8e31745f6ace140a9c2358abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654631, "uuid": "f579f87a-8612-4be6-83c1-a9e30596e97d", "comment": "Malware payload (Formbook)", "value": "d9dd4c3c1bb18d81c54fa6b3ba8e26ab32b6154418edeb9a7933b3649191e5e8081c1b0466447984db6703f95d02d6e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654631, "uuid": "59ff97e0-5858-4e1a-811a-781ed743ca12", "value": "3925BF9DB250B5DFC407CC338A586C60EA203877570BC217A02726AE997D9A7DF195F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654631, "uuid": "2b863ed2-9a4f-4e8a-acbf-2de374c51710", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654631, "uuid": "3faef8bf-44d2-44cd-a14e-f9f25ec1fe22", "value": "12288:FMAKBKimQJAPmI2MiTkZSP/HjN5+llmpygpuMQ7aLaTF/5howBEMWsooFgeTksBt:UCQJXciTLxol+usaTFBWH3UFg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654631, "uuid": "6fb056e7-ab6b-477e-9b23-423b663f2a47", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654631, "uuid": "b2a005dd-b24c-45d0-a662-8cd95074b9a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654631, "uuid": "c526ba25-9b59-4792-b079-9cd0850c1ea1", "value": "Receipt_Copy04062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eee75db-cd33-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623690715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623690715, "uuid": "0e4cac83-cd5c-4289-9e02-85e4cbe79bf4", "comment": "Malware payload", "value": "f976c1440227a83de660294311742e58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623690715, "uuid": "f71b9081-f07f-4413-8a6f-521431c6ebfa", "comment": "Malware payload", "value": "289178ce39286795a96ec32d1e73e123417a015b3940e741f2e7509e39c0fc65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623690715, "uuid": "b136329a-0bdc-4c6f-a66f-aae2722ebd10", "comment": "Malware payload", "value": "87b1d4c0cf7dee22d28465a9c649e3a8bb75d236", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623690715, "uuid": "89bb789e-5fac-42cf-8fc4-780d45b3d9fa", "comment": "Malware payload", "value": "85a017c7505ccb30a1fc2ab4dd3983d1848b8ab0a8d14ea6e6565acdd52022facc36f0b40febe3f71d61369028390447", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623690715, "uuid": "85a54e87-3795-4cf5-b771-0e933fc795c2", "value": "73F27C6C17506632CAFB0DF65493D6218B31876A1A06877B3CCDA6895F13AFC7F422A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623690715, "uuid": "4c413f67-9ae9-4095-bedd-d3bdc631ade7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623690715, "uuid": "dc4235bc-b68f-450d-bf38-b4e32ea9ef81", "value": "768:UdWnXbP/SV1RLH3jGObQbaCOBsp8Rr7Oh6W7YcLdjF:+0LCsbhOBpnkLtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623690715, "uuid": "ef682483-657f-4918-8cac-77347d898696", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623690715, "uuid": "5a7a863f-62f3-4e9f-b7e2-dc724554d327", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623690715, "uuid": "05c7104d-2dbd-4b6a-aa0e-4569d2cabc48", "value": "f976c1440227a83de660294311742e58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c926fb8-ccdb-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623652674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652674, "uuid": "fb53ec86-02af-4bd5-a04a-ac0bbc7398de", "comment": "Malware payload (Gafgyt)", "value": "167d59174e1f964662622588e64a216f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652674, "uuid": "62b052c6-6f99-4486-a148-d02f941614b1", "comment": "Malware payload (Gafgyt)", "value": "289f742c6539c8721c3606f96e5dad2ac535efcfb0e568e129e36260e4dc2f10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652674, "uuid": "6fc1aed8-18ad-4598-b05b-e1d1c1f35410", "comment": "Malware payload (Gafgyt)", "value": "3431f1f59eb6a60200a8a30165ec440fb674753a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652674, "uuid": "2b510de6-0090-4f28-9438-c9903bdb8a75", "comment": "Malware payload (Gafgyt)", "value": "f2354560b5887ac0e0194165e56d3a27337eab270a553bb2dca8a91c7278675eedfc0513d27972319b996f2c1577983e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652674, "uuid": "c3c61f84-c0b1-4072-9281-0dec9227d3ec", "value": "42C30805FC404B27C7E23BBAF79E438D773666586BD733116A295EB02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652674, "uuid": "48732d01-6ea8-4ab9-91af-e1ddba78c1b4", "value": "3072:0JDZ+6lJQTnoo3AK5nnyXxfW15hLFCuXUSP4eoC9DQlD6ObAF5R:7nyBu15hLFCuVhoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652674, "uuid": "9f4dcd54-205d-46d6-a52f-a93c8b74c957", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652674, "uuid": "79d1833c-2365-494a-bde2-923abaf5237e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652674, "uuid": "e68c6cff-8dbb-4184-9553-a8adfe6c437f", "value": "167d59174e1f964662622588e64a216f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c08c0e-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623650587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650587, "uuid": "cc7aa3b5-4b87-4ee1-8c51-74a5d10c04be", "comment": "Malware payload (Formbook)", "value": "8195f69628d544cea923ba128634c1dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650587, "uuid": "c40a7068-66fe-4abb-be46-60383b967a3d", "comment": "Malware payload (Formbook)", "value": "28c834cf56663a83f9344840d232064cddf4fc6bab31178abaec6146a924f9f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650587, "uuid": "d3dde075-e807-4ac0-983f-4ccb6e4d26bf", "comment": "Malware payload (Formbook)", "value": "5d15d5050e76120e171253201c83bce831440490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650587, "uuid": "413117ee-b6ea-4ea3-ac46-5da1177dab86", "comment": "Malware payload (Formbook)", "value": "3005d8a1cbdd222d373d6ba10459200111ff81e56872a06e9742cf208230f246db11e1a2605f482cf850a77e4d971d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650587, "uuid": "fb49303c-55cf-46b4-b0bc-26b186a12c23", "value": "623412A7A7C198FAE446077116B7E735D2F3BB46070346472B5C1E6B86020CBEA0DE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650587, "uuid": "651fc435-7781-43dc-a9b0-1df246cbd5cf", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650587, "uuid": "a265d9fc-c1c6-4e8e-8839-27040bcb6d5a", "value": "6144:Ds9ajIQSUiveeykCcbT5fUl65fu9q0ZhJGhsp4u:yav1zkCE9UFqo74u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650587, "uuid": "58c9c0c6-5202-4635-84d3-340cc06a43da", "value": 247337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650587, "uuid": "b4153e39-e05f-4b2d-9181-a2cb06f81ada", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650587, "uuid": "31565037-7c8a-49f3-9da7-e44dd36e99ea", "value": "Import Custom Duty invoice & its clearance documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f088fba-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652383, "uuid": "44fc79ee-c1e3-4c3b-9702-0db80b06b295", "comment": "Malware payload (Mirai)", "value": "ed314ff5b69fb04bfe65c90aa3ae690d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652383, "uuid": "064df818-ecd2-4078-82a7-8bc679b51cbd", "comment": "Malware payload (Mirai)", "value": "28e1a958b781f23cdea4e7ec1a1a7458c75004daaf2847362335f9d07358cf4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652383, "uuid": "a3aabced-329c-463f-9947-b319177ea6cc", "comment": "Malware payload (Mirai)", "value": "7492b410893713fa269dd42f40be1bd52e2f1965", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652383, "uuid": "6e335362-2f76-4b4d-aec0-c2e2ce5571fc", "comment": "Malware payload (Mirai)", "value": "c562934ccc82d2faf07fe9b1010b4b1d9fc867e910359c95409f9efe1449664341bcdee25725e7f301f46923cbb72fac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652383, "uuid": "aec7ec1e-67f3-493e-976f-0d260f6f14f3", "value": "5D14D77B27632A23D0D9147201E30231ECBADF5434BD6797A8D078792F39AA434967ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652383, "uuid": "fb2a42de-e219-4194-8edd-c9a59408274c", "value": "3072:a63mFc32q1vvJNPgrrcyZigmq0nMODxJa9MKK:a6WFc322JlgHBmq0nMODxJa9MKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652383, "uuid": "206c5280-2d83-4726-94f0-b770e3404802", "value": 193638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652383, "uuid": "44cf12f9-2561-491c-90e8-59f3ffa92fa3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652383, "uuid": "ee36e6f5-5012-48a4-902a-97ae383a622a", "value": "ed314ff5b69fb04bfe65c90aa3ae690d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54826acb-cccb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623645923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623645923, "uuid": "ff9df88c-4544-4eda-a9b4-118f7f2e4df3", "comment": "Malware payload", "value": "4921248519ec4f1df0df4f962cf62c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623645923, "uuid": "5b2ab0b4-2ece-4361-915d-b03698660d4c", "comment": "Malware payload", "value": "290203682933bc641f5a7a75e75efc475476c028031bdbd77dcd15a2daea536d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623645923, "uuid": "4a3c60a3-5844-48f0-9463-96042a79edfa", "comment": "Malware payload", "value": "8fd415729ab2ba434195c8985717b60914b270c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623645923, "uuid": "8483cd7d-dcea-4d02-bc8c-2ceebad6be09", "comment": "Malware payload", "value": "f508016c99b131def65009b7a1696a9c70353ee79a43c2f65b37374e6c839f56c82a84f3283559d81d212b6b80926676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623645923, "uuid": "dc4dae3a-d1e0-4c47-a03c-4ca66077ef67", "value": "A2A32861E28C7CE4C01746BBEC34FA08212BF74A452D495A79B6B51E64B22C374B7E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623645923, "uuid": "41e6f735-3917-4899-a963-343dd69a0271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623645923, "uuid": "3b90f34a-8d34-462a-af7a-7319808a6d23", "value": "1536:oCrvtvoUQHsIMqck7G0zRIytFfkhHUz2EPeUYs9a3SL:oa5QMIMqLi0tZtNk1Uz2EPeUYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623645923, "uuid": "f0d95597-8705-4b3d-8531-a6ec42d2849a", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623645923, "uuid": "d7b8c05c-415d-42b4-b530-80a6c0523d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623645923, "uuid": "0709bb13-86c1-44d4-8892-5eeea19eb966", "value": "\u0e23\u0e2b\u0e31\u0e2a _txt.Scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b813b81d-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629339, "uuid": "7ca64add-86e2-429e-8186-2675076b9f67", "comment": "Malware payload (Gelsemium)", "value": "1b6868f8c412e1e6efc4d7149173c5a9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629339, "uuid": "f7d01d86-ec04-41f1-bfb8-425d40611a37", "comment": "Malware payload (Gelsemium)", "value": "29e78ca3cb49dd2985a29e74cafb1a0a15515670da0f4881f6095fb2926bfefd", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629339, "uuid": "dbaa0d34-c126-4fa5-85a3-457854918221", "comment": "Malware payload (Gelsemium)", "value": "055f1e13e0fea44dc42e8cd8c9219ed588360304", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629339, "uuid": "026f6396-1909-4c4f-8657-f99620ba91c8", "comment": "Malware payload (Gelsemium)", "value": "fd6c2682b010d1ab1abbcd082b95bb67850af356e0b352e64b3f4ee99bc251abc73007c1589c51928d0b984c6245c970", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629339, "uuid": "39ef46f4-253c-4bc8-8ed0-8e603295e0e9", "value": "9FD4128BF6E01481F037447B41EDEBF78A77AC531F19A357AA44ED8B1C76681846238E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629339, "uuid": "cfbf8145-f507-4ac4-9fc8-81db9bcd9f16", "value": "62f9ee3659a560b7f7703609e076c878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629339, "uuid": "eba5c0c0-e461-4119-91ed-d78b1406c791", "value": "12288:9ckKAboFve5ITbgTjVz5qzfO83bRgzF5/qYjETiXdsH9lfmC7Un:YGIoThzEzJ3S5rWiNsdUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629339, "uuid": "7bd8869c-b194-4552-9f32-1380e4c4f2d6", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629339, "uuid": "9cbc82e8-e844-4f8f-844b-8caed9c27f5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629339, "uuid": "915e863f-c35e-4a97-9726-137be775dab5", "value": "29e78ca3cb49dd2985a29e74cafb1a0a15515670da0f4881f6095fb2926bfefd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6546c6cc-cd25-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623684606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684606, "uuid": "573150af-1900-406b-9fd9-5c1823f6e565", "comment": "Malware payload (Formbook)", "value": "5cea1235379d5c9fbe382c5514fd1335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684606, "uuid": "37a721bf-d00a-4a75-a820-c3b0088149a1", "comment": "Malware payload (Formbook)", "value": "29f449ce2c7c2d634c5f300c96104c5f1d7eca8d40acd7e9ffda42749e2fd307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684606, "uuid": "b659bc90-5424-4502-a7c2-e7af9dd71ec5", "comment": "Malware payload (Formbook)", "value": "95cdcbf148173ee6974ed875796821f8d1757dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684606, "uuid": "63411c4e-3ae5-4948-be69-27c7508a4794", "comment": "Malware payload (Formbook)", "value": "355ad1bb167ce57dc5083650829572a9cad891e28792853a53b5f4eb05caa5ea55499fe0caf1e5d5e6d74f817c18c943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684606, "uuid": "9291fe2a-0ed4-4062-84e7-df3cab650700", "value": "AB45D112B255C96AD02D89344472D1EC06F1FF8E6B68E64B3DC4BD6F7DB2384CA61B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684606, "uuid": "0c610fa9-b28f-4863-bad9-895332dd2fe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684606, "uuid": "c193dd9d-ef62-45f7-9c31-7b8148580a08", "value": "24576:4dT+Bqnt3h3f3m2XVf0XLTCkxrPMkPLd:4ABqt3h3ftKLTVLPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623684606, "uuid": "7db8d856-2e11-401f-84bb-a6c76b26e07b", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623684606, "uuid": "5ea0302b-d1b0-4774-b7f1-ed83b879df8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684606, "uuid": "329ff04a-98c4-4f69-b024-5b52809177d7", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f2c51b-ccea-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1623659365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659365, "uuid": "4219fa5e-5231-4979-9af9-b61a043fc2a6", "comment": "Malware payload (TeamBot)", "value": "7ee33c979214ac404e7b4de8554fbd6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659365, "uuid": "a379b48b-c6d8-4e41-97f6-126a2ac35592", "comment": "Malware payload (TeamBot)", "value": "2b3d02b58eac5231ea100f8fb4fc620ecd6be3b039a902da94c1f961bdb2e550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659365, "uuid": "135b732c-25a5-4c45-ae9b-391fb3e718f6", "comment": "Malware payload (TeamBot)", "value": "fe13acee216915b1140a46a1411c8c02134dab33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659365, "uuid": "e9737364-d809-41fb-871a-ca6b7bf4b1c0", "comment": "Malware payload (TeamBot)", "value": "45c496de2790cd9f39eed90b964d2637ef6540bcb36a5416aeb684a26b3079c159f720f33165c47e2e263cb0e803147f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659365, "uuid": "7108c156-1db9-4823-a34e-3ae8babb637c", "value": "67050100A3A1D0F5F1F312F859769F7995BE7EB0676490DF62C426EA1639AE0AC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659365, "uuid": "5c29fe22-d9ab-4793-9768-13b26fbd4635", "value": "58959b365b24aa3c98eb39fa519e2c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659365, "uuid": "5213b9d9-b994-4816-b218-f5ceb16c95e1", "value": "24576:tlXnReflosmaOgA+N9ZxxfSdYmuFLlsN:tfgeCOgAcZxxf89Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623659365, "uuid": "73dc23fa-fe2b-4142-8146-ebfb5e6d8813", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623659365, "uuid": "c7701216-9119-4b76-87f9-a429a1723bcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659365, "uuid": "404755ca-abd8-4b86-92bc-ccf216d1af41", "value": "7ee33c979214ac404e7b4de8554fbd6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6d32b7-cd09-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623672540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672540, "uuid": "4927aee3-a3e3-4ed3-ae40-05b059b9d866", "comment": "Malware payload (AgentTesla)", "value": "ed9969e26ce5824dced2f14eb8ca263a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672540, "uuid": "105955f8-e943-4d65-b8db-23a3faa96737", "comment": "Malware payload (AgentTesla)", "value": "2be3d6560c3a180d25206ea6600502eb5397314eae97aeec53b27e2a53b1fb1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672540, "uuid": "d31b0e6a-e8c4-4f55-ba67-0935449758cf", "comment": "Malware payload (AgentTesla)", "value": "b507f98aa03d4639d26de7c36101c850237f6cec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672540, "uuid": "bf93eeb1-fb7e-4cdc-8c22-a28c3dbc2859", "comment": "Malware payload (AgentTesla)", "value": "093655c16fc62a7ba80807eebb0a6dfa83adf798033b0e7ffb1ed8b1a9991fe45892bc4e4b170ca54347c36ab0d49ae7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672540, "uuid": "79372dc0-6601-46b5-bb14-fea3989c4576", "value": "5C05E02923C88755E5BE4738D269019093F1BC1BD325EB8DBE9D14DC0EA0F8187677AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672540, "uuid": "69ddd060-e62e-4c1c-8f16-4799312d6208", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672540, "uuid": "a41735b1-6f7c-4367-a135-e23e878f54b6", "value": "12288:JmekgaTLMnSXMyUAel+s6o3ESFtH7lmrWh8uteHtLxOmzLweLmApmGq9VCZ6v:pkdTLMSXMyrQ+SLNv6t8mvzmAQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623672540, "uuid": "44212520-06e2-47fa-97b9-4fbacc166f3c", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623672540, "uuid": "00b0d088-8460-448c-9ec3-1c9c78fbf007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672540, "uuid": "3ee59a4b-4044-4531-9f2b-69ee38bb28f2", "value": "QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd21e0d-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623653748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653748, "uuid": "4e7c0dd7-0906-44b7-9a89-9b43dc7f3d15", "comment": "Malware payload", "value": "269b6bef59715d1f814b156875cf681a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653748, "uuid": "bf1383df-1894-40de-8166-eb5b5ef0ab0e", "comment": "Malware payload", "value": "2bee4cfccf22c54d1beec799350e9056f1660286d712cf6482643aebff1d88b0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653748, "uuid": "f0ac0946-5dee-4068-865d-a854258b53b8", "comment": "Malware payload", "value": "0d77166bc831fe6edbb80e4219cea9d74c29d917", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653748, "uuid": "fcb5db0d-40a5-4363-859f-1b45b6085de3", "comment": "Malware payload", "value": "f654498276c60949073a401d4e097c6302a341b0492b0ccb74d1595af39dbc1b11c3a7d51790041c9f9b849235d28b44", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653748, "uuid": "6ab0ef3d-112b-41cb-ae60-1f0efab5c6ee", "value": "3351ED100AE61798D37257375FEDF2669A32F865F83DDF7A4140928447265409C71F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653748, "uuid": "e0412e2f-aab2-4612-846b-94e0eaa9c959", "value": "48:8WolBHps7xdjqH5ma/eW6ao/gwEgomaR20w:8bBWri56BYjg57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653748, "uuid": "2797cd62-3c7e-4d7a-936a-55dc225fe781", "value": 2533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653748, "uuid": "0f4f4e9e-1e72-4b95-835b-431fe8ff25ad", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653748, "uuid": "89aa09de-6aea-4cf6-965a-12bc7df45e6c", "value": "List.rtf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ca3c95-ccec-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623660201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660201, "uuid": "a9f32010-d2d8-49ed-a40e-779c111b48ee", "comment": "Malware payload (AgentTesla)", "value": "b74c6eac5ef1aeef99933ff9bca06f41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660201, "uuid": "00d5052a-9e7e-4d78-842e-b3599d249c04", "comment": "Malware payload (AgentTesla)", "value": "2c2e81670457af4e8cf55326d26fc449a1a30b1e047d2abe9a5faaebb4024f4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660201, "uuid": "f234736c-f0a8-4cd5-bf36-e964a37e9c67", "comment": "Malware payload (AgentTesla)", "value": "da457fa8b5c8c926c209fd80c7888c7f7f5d2340", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660201, "uuid": "ff1ede6a-1a37-4bb6-96d7-7ca085795395", "comment": "Malware payload (AgentTesla)", "value": "df740e1d8f89cb5f896d40b5f6a2531f8564659d246c3e24d3aa5923214f6026d7103b0f6c9698c2d97a993649084a87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660201, "uuid": "ca306fcc-5988-472c-8b98-5aa081909f5f", "value": "242423BCE3362A52D3DF6A0CB24819EB3AC23E552D11D3D538636DA11AED57FB49D008", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660201, "uuid": "6f81dcc4-bf32-4d10-a997-40f7be436687", "value": "6144:KxnyTsFU5C4OJo2DZb/4iHgPvCerQ/htgM:KxyTsFZ4OW2DZ74me6GQ/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623660201, "uuid": "79328d78-a98c-41cc-8959-f0493f3e4b44", "value": 214675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623660201, "uuid": "55b4827d-5fdc-4c5a-8e6e-51e0358b2545", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660201, "uuid": "1936b156-fed0-4e4b-92f5-e048ffc6c89d", "value": "Shipping Docs.Commercial Invoice. Packing List. Bill of LandingTHS0094587.r17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ce96c4-ccb3-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623635624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635624, "uuid": "c9d15409-83d5-4b97-837e-b12de776b79b", "comment": "Malware payload (Gafgyt)", "value": "72e9cab317d8a7c7392c484359921eb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635624, "uuid": "e01b8b50-6f53-4220-bb9c-bc00ddef37d9", "comment": "Malware payload (Gafgyt)", "value": "2d3e26e4776355bff336dd0b5c5b5cc01c4886decfc4aa4c5fd87713076b94ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635624, "uuid": "dfe5f0da-93d7-4b74-ab48-244946042656", "comment": "Malware payload (Gafgyt)", "value": "4b80b66a074de9b38b7f61d335271c2b33054943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635624, "uuid": "ff0e3159-43f6-4606-97bd-b0a5044a329a", "comment": "Malware payload (Gafgyt)", "value": "a966e51a8f0ce824a5e48d70073f3ee17752e8223f8b3568e6d6f9dbf6e691eac43787208a741b15a6c770c6e22d899f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635624, "uuid": "864162fa-464b-46df-be36-cc879b327f3d", "value": "18A35B82D642C2F3C4430AF1029F965A0532FB3A8E3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635624, "uuid": "20b658a1-4282-4c0c-b204-a41b8e9acb5f", "value": "3072:mj2qjPQP39VjGWX98732V7kGyNVu5heTR7FXnf0OzTyoQQub:mJQP39VjGWXW9NVu5h+xFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635624, "uuid": "383ffc04-77db-437b-b2a9-3a824cd9482c", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635624, "uuid": "7271c914-d19a-42ae-92b0-4f2d73e2cb94", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635624, "uuid": "b93f6a7f-5d53-4c0c-ba52-1333c63c8716", "value": "72e9cab317d8a7c7392c484359921eb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfbc20a-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623651843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651843, "uuid": "1e183ebe-6474-4cfd-8d4a-17c576d25fb2", "comment": "Malware payload (Gafgyt)", "value": "37e03bc6087b9925235ca1319683e1d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651843, "uuid": "144b42c4-8bbc-433b-938e-3d745265a56e", "comment": "Malware payload (Gafgyt)", "value": "2d3fb638f08df96e45631418d23db7ce7a9ff2f443e1f5c9a140f70d21d909c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651843, "uuid": "b1fb2cec-04e0-4b59-ab0b-4c33dbbcd130", "comment": "Malware payload (Gafgyt)", "value": "c0b10a8282a37e8b3cec2d4ad4c553ec58463db1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651843, "uuid": "3c3db466-dc17-4723-80d6-93e9ed78b9cc", "comment": "Malware payload (Gafgyt)", "value": "86d213c0bb132361fe301c2e661fc6980942638b1a204924644912724cba7cdfe69e0eaf7a0a12204421084c94399ae0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651843, "uuid": "120eca00-0b1f-4481-be9a-8312206b614d", "value": "08C32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651843, "uuid": "3d2a569c-dfcc-43c4-9818-5fb7cbd80acb", "value": "3072:/YNa/GLBNPoQiphakpiQ9/nYEP/UnSQf/R:6a/yloJphakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651843, "uuid": "69304823-d845-4203-bbef-fb48b731a59d", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651843, "uuid": "eb3d3149-4140-4e28-b095-2b7a7de591ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651843, "uuid": "7c3a33bc-c80f-470d-aa75-1f1bc3f213a0", "value": "37e03bc6087b9925235ca1319683e1d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e673350a-cd1c-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623680957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680957, "uuid": "e78a7fcd-006c-41da-bfc2-b1b1ffbbad73", "comment": "Malware payload (DanaBot)", "value": "1f5c2c56cc3b0b3552512bae5ee65e2e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680957, "uuid": "ca78775c-063b-4c6a-8db2-c26b86b80db2", "comment": "Malware payload (DanaBot)", "value": "2dc257664c9b3bf2d5b1519c4d6951ce3ce674a15fdf7578f18c6e8ff2e3073f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680957, "uuid": "c0c308a5-3cee-406f-bf76-cd5a4c6e5f57", "comment": "Malware payload (DanaBot)", "value": "48ce8806626dbf97cde8a6ca3d5900c48828537c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680957, "uuid": "ec22d2df-5103-4fe9-9b55-4ba4cd783579", "comment": "Malware payload (DanaBot)", "value": "da25a684d97a265f4358f9d4cb8f115fa5ae63ca4a08676af020bb512d65e00f53a1cd2d944de29935187c72916f1bc8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680957, "uuid": "800c0c64-9bd9-4e7c-a34d-1f867b80e7b3", "value": "57563300E2B0D4E5F16A26FCC8395A78D08D7A709B3172DB11D676DB62739E86C31B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680957, "uuid": "3286ca1c-443c-461b-b757-93a6d2c3cc07", "value": "a839cd84f6a5cda828209579a8ea9768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680957, "uuid": "d14ef59a-ecca-49cf-9c2e-efea94ddabdd", "value": "98304:j93f7CrmF/IuZjiiCfSB8TqnyvccFs5j0Cv6WKjGXUlwqwx4Rns6A13jTp13QGPK:jhfgEliiOSBbyvc/ly/LRIPjQtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623680957, "uuid": "36cebe3b-ab55-4cdc-bfa3-03d59fde02f2", "value": 6365696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623680957, "uuid": "16c59f8d-f50b-4b80-9980-2590dd0f89ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680957, "uuid": "e3f924fb-04f8-41fd-b20f-1497dafcfda2", "value": "1f5c2c56cc3b0b3552512bae5ee65e2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0996e2-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623650531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650531, "uuid": "a2bc8c8f-426c-4767-b2b8-f321b998e7a8", "comment": "Malware payload (Formbook)", "value": "215ed7bff2d6764ffba5733ab96357e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650531, "uuid": "669f4065-672c-479c-94eb-e5f98d4d419e", "comment": "Malware payload (Formbook)", "value": "2f37c93400fdd92118fb19c318001038022836301f00dd805b0e97fd53773d5d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650531, "uuid": "840b6d82-98d9-441b-9947-ec5d11f4621f", "comment": "Malware payload (Formbook)", "value": "8441f93049f689b2c7e55f870dd3f35c88c90bc5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650531, "uuid": "6c8a95e3-baa9-47d6-9463-ff166fc0972b", "comment": "Malware payload (Formbook)", "value": "4871d94b03565c52d4527da0a9a5b66bde1f5cdac40894c3be199528a9d42bae6707188f0af38fe783f543338adb78c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650531, "uuid": "031d2266-b186-4382-aa8b-257bdd4921a2", "value": "367186A213F0C0F0E15826716D535709D5B9B2F0D77297343BE07A1F2C7B551286CB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650531, "uuid": "6e5bc6ab-974b-4022-949a-975353e8b3e3", "value": "d4e6ea9ec0efe39b1cb7664384899294", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650531, "uuid": "ea09a0c7-05c1-41d7-94d5-e6339a6caca5", "value": "24:ZHGStXRm/6mvt3XkDyv30NP7HHAWeilIvTy9xoDWS/MRvrBL/Aki:Zvt9mlq23ePjNlI7y9xovovrBLzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650531, "uuid": "17b38a73-16e9-45a2-8a27-00d7588797dd", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650531, "uuid": "c342473f-4116-42bf-a91d-13bc68ec14ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650531, "uuid": "c2a76ebd-61e1-4dbd-9794-fe8d8ed18797", "value": "Product_Inquiry.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26210d3-cce0-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1623655207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655207, "uuid": "19b9165a-54ee-4aae-8bd3-806297d9eec7", "comment": "Malware payload (LimeRAT)", "value": "540bdbab04cff1055947c53c44ac8110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655207, "uuid": "9e1b4b3e-183f-44a3-a1f7-3179a86008a5", "comment": "Malware payload (LimeRAT)", "value": "305514746c30fc10a9a4adbd87a6d7c63d55360442abcbc41933ec6efceb5fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655207, "uuid": "26c7ec7c-c269-4713-99bc-d5e275ce061f", "comment": "Malware payload (LimeRAT)", "value": "8b701b905f08530e9a132382d65aac6cd8ac96aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655207, "uuid": "b33e6110-7df9-4bdb-82ac-9312763320b0", "comment": "Malware payload (LimeRAT)", "value": "41c5003d1c3c8be329ba5cc946d14d0177b9918943d2019ac352e7a09620662a27455b07513fde0f5ac336c478afd3df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655207, "uuid": "1b638448-0145-4ba5-9d6d-2971dcc212bc", "value": "07E4E02623C88B52E67E4734A165019093F1FC1BD325EBCDBD9A14DD1BB0F819362B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655207, "uuid": "a47fb884-d794-47d4-a0de-ca43321b9786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655207, "uuid": "f8966d40-d725-4d0b-85fc-d33236741c05", "value": "12288:BXseVAaTLMMlsU9b8+OfAGy3OWB8VFd+p9VCZ6v:RNV9TLMMlsUt8zf/4OWBAd+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623655207, "uuid": "376de987-3bbb-464b-9b30-e675c3ccc086", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623655207, "uuid": "a34960f1-52fb-4173-9428-55ea90713b14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655207, "uuid": "8b603dea-50c8-438e-a042-42a5079b0bf0", "value": "540bdbab04cff1055947c53c44ac8110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc63f4da-ccc5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623643547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643547, "uuid": "6f8d96a4-6c79-46f1-9873-945a73bfb2f5", "comment": "Malware payload", "value": "3e1936560764da4e13811919dbd3a4f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643547, "uuid": "c68b9f38-eda9-42e2-9ac4-c15b8e1537b9", "comment": "Malware payload", "value": "3061f16516474c0460c0f5148af1dc891f95b069788173bdc47698af0f1ea4a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643547, "uuid": "6de9c372-9ffb-45c2-b196-7d1b36834ecb", "comment": "Malware payload", "value": "f8928b566f1130749d2b67e9cea7c4ef479eeca6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643547, "uuid": "67a99762-b8ea-48aa-a270-8e5c694b47c9", "comment": "Malware payload", "value": "bdb9e1f67d1cfbd5ab2b690ca124a94f0ed6bedf40ab4c7a85c8b84b08672510df4c21a249083133e9370c7e50efce89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643547, "uuid": "c4feeb0e-8e60-4659-af4d-02918b0da75b", "value": "3F2602207E82C132E5728170AD7DAB6E54BC7B750B7691DBA3C80E6E09705C35B3A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643547, "uuid": "612d3570-a272-4876-83e3-898b41143bf5", "value": "d9c9b2207194e3b00f67e3fec7ad5f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643547, "uuid": "56600017-323a-4514-bd7e-d57f856ac47e", "value": "98304:y1wpL+wIIRn5P3NvdO9wgAIHM+gStdXeQzjumyCzEpqJ:Sw4O15P3NvZgAIs+lfeQuZQzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623643547, "uuid": "5bfbc4ed-fb8b-4f16-8149-60f883a9850d", "value": 4783072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623643547, "uuid": "55ee8d53-5a2d-4967-9a08-8f61e0540354", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643547, "uuid": "96d7f602-ce20-4d61-aa47-806b552bd03a", "value": "3e1936560764da4e13811919dbd3a4f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debbffec-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623653886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653886, "uuid": "efcff172-1794-46bc-8537-86c0b0313a4b", "comment": "Malware payload (Formbook)", "value": "4919e65a61768e2c70beb4b56facf42c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653886, "uuid": "a6eca8d5-d6bb-4ad6-8e42-5df9517dad6a", "comment": "Malware payload (Formbook)", "value": "312d532cc972a66a43c91042846202cea8d764ff8fa402deb1c26d8410d38f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653886, "uuid": "84688aa3-662d-49bf-96ca-c11011405438", "comment": "Malware payload (Formbook)", "value": "cfff83a780895852c3590757eb237e2285ed4069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653886, "uuid": "f8e99af0-61ae-4e0f-824e-80d9d89b023a", "comment": "Malware payload (Formbook)", "value": "4cdb7c9ab145dcec5a37b1140fb21d04406cf849f616f9e1eb9eb6ef2b74a9b4692538700f189a564588c4751945ba32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653886, "uuid": "e3366ace-cf5e-48b5-a238-413db61371ce", "value": "AEA4F1427673E4BBDCC51078185F39C0156F3E22467E30F963A236E95E713EE5829A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653886, "uuid": "c014adce-6be6-4e63-a534-82576c56de09", "value": "b840b1c1d0d81f6853fb6cabdba055e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653886, "uuid": "9e60f194-a44f-4ed1-b281-72233a27089f", "value": "12288:ykUOdi1OC0tesWTqlQq4cbT+6UdtZGw9td:274eZTzzMTn+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653886, "uuid": "6e616286-33fa-4c9c-b00c-8f2a6de04b8a", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653886, "uuid": "fe5fdf68-204d-4ff2-95fb-9f17588e1b78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653886, "uuid": "323df217-05d6-4086-8d1b-155c864ba00b", "value": "DHL ADDRESS FORM_4455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790a3c3c-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658869, "uuid": "747beab5-d4a0-4d4d-9516-648e3752f8e9", "comment": "Malware payload", "value": "41957e3a46f80e10e2ef89ac565cc5ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658869, "uuid": "e5f2127b-0d1e-4829-9b91-392e5dde4a48", "comment": "Malware payload", "value": "3134b5fd08de63d297d25c334e59dbdc4bd83c2accff06900d3d03d1e68e6635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658869, "uuid": "048a7205-df9f-49cc-9386-0e7805cbe4ec", "comment": "Malware payload", "value": "c36fbfbda82ad91cfa609065363f461e0e7dca69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658869, "uuid": "2d5c3e81-2feb-4a46-9960-0ce9bb04e712", "comment": "Malware payload", "value": "130dbce76094fdde74211dfb4134721c1c21f6ada633ada7b10e61016facbe3d7920ece9fedf4a20b6f1a7a012bbd92f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658869, "uuid": "2a0e4a6d-2ccd-4de3-a05b-eb372656bbb7", "value": "64F522426581ECB1E6A0D8324935FA731534EC343B08895A5BF48E5BFD3E698DE12E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658869, "uuid": "39e02f0e-aa3c-44aa-856b-f7ab5c17cf87", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658869, "uuid": "e87c4eff-47be-4a48-8b16-ea637afbd424", "value": "98304:9baoIsWvLwZ95lQDYB3ppPKYIx3VyHG+o:9monhZrlBB5pXIxsmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658869, "uuid": "ad4d001a-adf6-4cd8-b88d-2230115599a1", "value": 3355350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658869, "uuid": "6f6656bf-ac2d-4de8-84ac-7b03fdd99b25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658869, "uuid": "316596f3-6ded-4700-80c4-c0bd00c1cf82", "value": "41957e3a46f80e10e2ef89ac565cc5ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbbaa93-cd4b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623700912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700912, "uuid": "f9709467-31e9-46b8-854f-21dd535bcc6f", "comment": "Malware payload (Loki)", "value": "0dfe325b6658098ba2e2220f76c1d5c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700912, "uuid": "d01c2662-89b1-4236-a0da-b7bad9189247", "comment": "Malware payload (Loki)", "value": "3262231e4fa0d02c50f21c221476da114e6c7878aebe226940d0839dc7abe2ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700912, "uuid": "68ba77f0-6427-44e7-980f-1d9c57444aae", "comment": "Malware payload (Loki)", "value": "f37fbfa7747df3d8dddbc01f0f303b654b772d08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700912, "uuid": "a026670b-f7e7-4061-92ec-894d54222e37", "comment": "Malware payload (Loki)", "value": "19adaa4d2df44a7ca842c8ed8bab84b47c62657101b881aebcf7fec77585991e4e66ba3e57fddc3615a64a28d6b6f330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700912, "uuid": "91df796d-c78f-45bc-9350-e17f4455dcac", "value": "17F302AA20D1C473F1171F730AB7AF9BE3FBB744A621019B97551FAF6A228C35405643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700912, "uuid": "4df654b7-5449-44c8-841b-d2f57c06dd51", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700912, "uuid": "b59bf4ce-1f0e-4d92-b41a-6929f886c735", "value": "3072:DQIURTXJ+MhuzR8FEJso1H7K9chcfORIhb0VpxWS2mhV:Ds9UzRDmEH7K8hvIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623700912, "uuid": "56049b02-7a80-49cd-a0db-4b0e1f26b7e1", "value": 165584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623700912, "uuid": "1da6e7e8-d309-47f3-a14f-a6e1ea34deba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700912, "uuid": "a2e099a0-c28c-47f6-8415-b6e314652d6d", "value": "0DFE325B6658098BA2E2220F76C1D5C8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af778ec-cd40-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623696265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623696265, "uuid": "c7c5a77a-d611-4e1b-8c27-51f56e32eb91", "comment": "Malware payload", "value": "76d9ad731b3417ce329035c3497d19eb", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623696265, "uuid": "f1c153e0-43ed-4f6b-be68-d528ab2554e4", "comment": "Malware payload", "value": "32d52214cf5e988fcea03d7edc9f775b22da0a886c75f37ceebd9a0b054a1391", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623696265, "uuid": "847e7581-09c2-4519-9707-8aee129d6667", "comment": "Malware payload", "value": "8e1ccb1aa620255a8205fbb44e705472b2fc9e93", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623696265, "uuid": "6afbcfca-e758-4714-a9e0-3ee49afda5c4", "comment": "Malware payload", "value": "5846d1975d3cf0b7f34aeb4afc6074e5306d6aba26ccc14851096346bb3d01da37f6bf9f23c2f91694d329c032b5127d", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623696265, "uuid": "65cf3d11-b047-47fd-964f-4ae1792b351a", "value": "0705F162FB688A27C45903360D46D7872379FDA68F3B1207B2E4370E4F79698D523716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623696265, "uuid": "636addbe-690f-4649-ac1b-717486ffe990", "value": "24576:fiOvq0l6lWl5lhYJ+elPxB0jELJvQ+FmbHvihdC/16eCSxo2:Jzl6lWl5lhKhlPxmjs22mLi/CoVd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623696265, "uuid": "1964e6df-01c0-4eeb-b1fe-5975d7819264", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623696265, "uuid": "94e43135-fe97-4b52-a648-1c234e858d4b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623696265, "uuid": "920cc63b-2c6d-432a-b7f2-3032567775fb", "value": "76d9ad731b3417ce329035c3497d19eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e842323f-cd06-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623671511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671511, "uuid": "1b7cc3a3-585d-4072-aa1a-fbc03f26fe49", "comment": "Malware payload (OskiStealer)", "value": "356b956d815f1109191601ad7a46254c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671511, "uuid": "012a2c33-81d9-458f-ae80-9049ac873314", "comment": "Malware payload (OskiStealer)", "value": "334c645037cba54c899de0aa0110e972787ef336fd17779d471720cfb57a03f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671511, "uuid": "768efae6-6aea-4d6d-9433-9ce3713cf459", "comment": "Malware payload (OskiStealer)", "value": "ecb3000c9ad16922bc45625a389bc827920cf0a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671511, "uuid": "8aa0e450-3dbf-49a0-9dc5-84dc68e8650b", "comment": "Malware payload (OskiStealer)", "value": "9bc79ed74a92311f9940d4df6845d3cd18c186ff6d2e1016733a9cc7e0220dba46bcacce196f707388b345c32ac8e549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671511, "uuid": "7db7a978-995a-45f6-a428-8a59f3fa2a01", "value": "F3D52313FF8488B2C4A16830891DB68246797C755F15AE97F7DC392D9E340C0BA3A6F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671511, "uuid": "f3e10fa2-49c3-4b65-9a3e-343868546bc6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671511, "uuid": "673b5677-f90e-4921-80de-50a9ec17fc3f", "value": "49152:D3dnmJj9Nbdcy9Zszar4wBGCAmeJVTDo01vKDbv1lK0q/robdgQ+UxOQ0:DJCNbd/Z9rhBGueJVo01qHKh/robXBv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671511, "uuid": "5aa9c31d-40e8-4f7f-8839-b8f865fc5dfa", "value": 2948139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671511, "uuid": "dfc456e8-19a7-4da5-9856-3bbd2d29ec3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671511, "uuid": "1997870a-485e-48a0-a25e-856b1defb39e", "value": "SecuriteInfo.com.Trojan.GenericKD.46442268.32035.3487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657ee016-cd02-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623669574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669574, "uuid": "3eda85da-652b-49b7-9431-cd42b8dd9b3d", "comment": "Malware payload (SnakeKeylogger)", "value": "571db81b25298d3b3bfb6d19ce03f71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669574, "uuid": "aa783ee2-3d95-4047-903a-a5a902f0d213", "comment": "Malware payload (SnakeKeylogger)", "value": "3390c123938c77d21a6ae1dc750265427ea0fb5f5dd3571a9f2dcb069ee66812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669574, "uuid": "a88bfd44-7621-496a-b5ae-b891bea44814", "comment": "Malware payload (SnakeKeylogger)", "value": "51a2943db0dc44abae2034d24fdd8fb4394456b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669574, "uuid": "10c036d5-35e9-4ea5-b0cb-77fda67d4018", "comment": "Malware payload (SnakeKeylogger)", "value": "96a5f09ef2fdeceb2a8960d394cfb4e07cd69f51a7806f9446703700e0feaf620fdbdbbe1126b5aa954c5df610840537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669574, "uuid": "0661e9c9-7538-47c9-b4a0-f0a2919e95de", "value": "4B34022616E72402DDC90FF65EE19C1AA1F9E740192F49E7354A293FC846BCFE70712A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669574, "uuid": "d8a55e4b-1142-45ba-af62-bd2a57bfe671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669574, "uuid": "7e142f5f-a04a-4c1c-974d-b1e40b7667af", "value": "6144:ml39X25cA1Ej0OVe+Y+Fnilx8iPioxvg6B/qU1:YtGB6gee1Mnilzc1U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623669574, "uuid": "ca600622-4099-4ed5-a7c4-1bd21f6cdf47", "value": 246256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623669574, "uuid": "824f61a7-0995-45aa-be4f-8fbebfc23cb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669574, "uuid": "779ce858-bbed-4249-b58e-9a7eba15bfb4", "value": "RFL_022_610_377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a91280-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623652176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652176, "uuid": "2e00b6ea-25c0-4654-8f76-d31117767224", "comment": "Malware payload", "value": "da34cd51aa573a74ef916bae611d4b50", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652176, "uuid": "bea9d655-144d-4caa-b5f7-27c3136ed270", "comment": "Malware payload", "value": "346e29f3720f527f532d564b78623e6c94346bf0fc42ad7fe90f0182918937c5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652176, "uuid": "d880ce0d-613f-4d9d-a630-964952dc941c", "comment": "Malware payload", "value": "00b460c37b8d0ac782c0db13ed00d7795c668958", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652176, "uuid": "8447fe9e-26ea-459f-a136-af0a44cd83be", "comment": "Malware payload", "value": "6ec48f46c123f0f1275c429550e018be70aada1a7f219ec8046fb583cc73cfceca895f61d6b7af13796a163f6ecba53e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652176, "uuid": "cb7ac374-b80b-4389-819f-33bdf313d776", "value": "A0A4EC9488AB6271F2405E8D7194B2896A75BF9330D9CC2563FE8635CF716F66EC02C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652176, "uuid": "f705160f-5705-4608-9cf9-0465ea11e1b4", "value": "3072:9gBrB2BrBuuFsjpTMnCf8CGvYdzFDr5RDAw5wf/:cVcVuu+8CGvYdzFD1RDAUw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652176, "uuid": "8d57c739-1feb-4e6a-ac3b-a091c4c496ef", "value": 471030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652176, "uuid": "0f3348da-44fa-4695-94dc-667931570436", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652176, "uuid": "3c753be5-2e95-4b28-ac04-2165b726c119", "value": "SwiftXCopy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faecf0b9-ccdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623653074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653074, "uuid": "73dad9d6-d039-4e01-925a-b8f196dc0f50", "comment": "Malware payload", "value": "fdeff7b57d4be10e818d15cc03a32b24", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653074, "uuid": "ae2f6c54-f639-46a3-9776-aedbfcaf1a6a", "comment": "Malware payload", "value": "35c6702312324536c0cb20bfc4109d931591824cad927c5bb3120443c297ee23", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653074, "uuid": "d61418b4-b45d-4924-9be3-f759fbbae760", "comment": "Malware payload", "value": "e9aec8fdf233e2314d4ecd8acecfa5461078ce7f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653074, "uuid": "062147c4-6660-46b5-b24b-241ea75e9a5d", "comment": "Malware payload", "value": "795d073338ecf05cf073de5f948c71484b2fadb0fc569772d8aea7cc31e59ffbdf157744cf1973c3212a3e77aebead1f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653074, "uuid": "96e87c9a-7d30-47fc-97ea-90bfc3cba017", "value": "9C1412478E5C586CCC32543C182D449F794CDAD3CEE1B6BC2A6AF6E20F3891B4995CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653074, "uuid": "f0406104-ef7b-4bba-b889-1b2564374775", "value": "3072:rMwOBzK4Rkss+TgNonqzg1ZN2gwT+dSsLnUPaO8qd/itNF76QIXrUlkgd:rMwW+sUQemYTmYoKatr6QUEDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653074, "uuid": "fd454c80-4bd4-43c3-8d41-908a242d3885", "value": 197757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653074, "uuid": "acf7641b-a799-47b5-a55d-9bf51d66e99f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653074, "uuid": "42e4d1bd-e50d-4086-90c4-395b390d8be5", "value": "Project list.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493ba2c5-ccfe-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623667808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667808, "uuid": "41713f30-8e15-4de2-a3eb-122b681d4561", "comment": "Malware payload (SnakeKeylogger)", "value": "0ab444908d3909a9f779759b1de424a9", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667808, "uuid": "cca3d8c8-24ee-45c1-a415-c69bd1ff36d2", "comment": "Malware payload (SnakeKeylogger)", "value": "35fe4d13edb8fcf545858fe817a21df4cee10abb4320014384f7096f6e05b814", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667808, "uuid": "0a50e550-6879-4107-ab36-ebcbe3a03de4", "comment": "Malware payload (SnakeKeylogger)", "value": "df1267a71bd09480c03f354fd4b7f08a68fddf56", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667808, "uuid": "8ad5d1a6-b19a-4be8-9ebe-ca5a848ba685", "comment": "Malware payload (SnakeKeylogger)", "value": "712b6203abe749e6b1adae9e7b3254fcc573a44d08fdeae3459c39602a3864b15bbe9bbc222f347a93d510f128598468", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667808, "uuid": "e37c5f15-7ef9-438a-9a44-8b7dd347b7bc", "value": "4D02292E85D6CCE9C775D1B240480B42EB51B442425B3D0AF3AAD998EDBF2F70F69984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667808, "uuid": "31a4babe-ccb3-4f62-8c5a-b5fe03384c76", "value": "192:nMfnF6oQBsRMhvI7kVJHRgsw33V5ayFYEEUF7brjz6:nMt6ogsZ7apmX3BJRFn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667808, "uuid": "79efd22b-0f1d-48dd-9bd8-29669cd8b29d", "value": 8638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667808, "uuid": "29f75ed4-e610-49c6-9a4d-711fc508ceaa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667808, "uuid": "fb1b7c67-7b65-4959-a278-9c9edabd70c6", "value": "Specification .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e514de3-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623654556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654556, "uuid": "78f0ba5c-87ed-480e-ae1d-7a8e26097f2b", "comment": "Malware payload (SnakeKeylogger)", "value": "c85f2d8f5a86487fc3bb64b0f6f434c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654556, "uuid": "b29808f1-87ca-4680-99ea-f38b383a5491", "comment": "Malware payload (SnakeKeylogger)", "value": "365469997e252207500037ab70d866373c51212be7725d0cb9ec68e0dd2a2221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654556, "uuid": "2c42aa3f-e57f-455d-b649-467b618511d9", "comment": "Malware payload (SnakeKeylogger)", "value": "033e33e0341474989e470af5fc71e828c0c93a72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654556, "uuid": "640ecba5-64e6-4238-a77a-a617d2e99ada", "comment": "Malware payload (SnakeKeylogger)", "value": "56ebb2d3f5fbbdead5d667b9a08fc1f4f76fa579561bc2fce6a0b7d7d4a24bda8f46d1406b9e8e4ce858eccd38f2febc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654556, "uuid": "fa1c78d0-05af-408d-9cea-5f85b2f89ca1", "value": "5EF46CF4F198A9B0D15DC732C7909CADE7A116FE9343895C1AB9CACC1F03B8A9F99441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654556, "uuid": "458121c9-4f98-4110-a779-878bc2c1bd63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654556, "uuid": "0daa4490-150e-4c4f-9da5-80114185a905", "value": "12288:haKamvTRioAvL5GprqBqu7zkOOjnVv8MmrG6mDfRB:haKkoe5GZqAlNxmefRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654556, "uuid": "cf9dff83-ed8f-4bee-8630-10d3888719e0", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654556, "uuid": "b5a4534a-ac2b-4ceb-82f8-ef0fd02a70b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654556, "uuid": "38db0b1a-d0f3-49b1-a47d-571f473e7add", "value": "scan20210406_0019939010010010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d21239-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623652211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652211, "uuid": "9809a681-66bd-4ac1-930c-fe37666867e1", "comment": "Malware payload (GuLoader)", "value": "0ff57b2fd3fb489d3cca1e3de4fc98ea", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652211, "uuid": "989aaaab-402f-4b50-9f07-0a7d55a45127", "comment": "Malware payload (GuLoader)", "value": "36e8b5e6839f88f144b51f690004f0464368d437d099fa74534fe1a6223a6ed2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652211, "uuid": "d97e9a65-8f4e-4de7-a58d-34b700e6f287", "comment": "Malware payload (GuLoader)", "value": "48f428a33c81e6647c399a50a71e5ee03c1c2ef9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652211, "uuid": "08b7d187-6d3f-488a-9b93-8cd8cabfc8c8", "comment": "Malware payload (GuLoader)", "value": "015b4ddc73e1265aafd57f5aedb5da514d2fe2833ba16f4b9ff20bf82e47110b0f3eba3b0d18b9959d715419f60d43f9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652211, "uuid": "140e6dc7-3ea1-4731-87df-5eeb8ee5dcbd", "value": "CF553317FFF00B73E1EE9F3D91AAD21A04E46DD2B0949827369E35A5F87927091E5308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652211, "uuid": "cf7aab6f-7313-42ef-8eaa-cb45fa13bd14", "value": "24576:3EABhEpaKxCPPlkiKLeUapEyKoomeKGjTVE2X4ldfvr1rd9Nxsa:tBhEwKx+KLe25mCX4zj1rdfxsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652211, "uuid": "5683720e-9702-41ce-90c3-c1388cb435d5", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652211, "uuid": "ed838075-6be5-4bc4-bf33-b0bbcc19a0a1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652211, "uuid": "3cd0cbd2-669b-487b-a44c-74feda46bb2f", "value": "Booking Confirmation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b77edc7-ccd0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623648028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648028, "uuid": "82174bef-8f67-4acf-9b0b-0538eb03fa37", "comment": "Malware payload (SnakeKeylogger)", "value": "86db2fac757f95b38389a67510ff0714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648028, "uuid": "9c532e97-767a-494d-9b55-cb57221396fa", "comment": "Malware payload (SnakeKeylogger)", "value": "37dd51644842285e502a8df1450ceb84d80dfdcd87620cc8683874d4b41bd092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648028, "uuid": "22369339-1127-4f83-8449-6dbebd214e19", "comment": "Malware payload (SnakeKeylogger)", "value": "c23afc4dff61599aef46d62bfe0012c0e752c213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648028, "uuid": "430279c0-96a9-4293-977a-4396f2d6fc20", "comment": "Malware payload (SnakeKeylogger)", "value": "5fd1509b36f1369752ccb4771abbd8b2d67fa37a692c36acbb05148512648742cb38843ca46e10a7cd2b2a75a32df2b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648028, "uuid": "a8d1aa18-e9f6-4652-85db-263990d333f8", "value": "88D42222E6D0035DCD7F13758AA1900647FCEE02667BCB1E9D99707939B33760AC2A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648028, "uuid": "3c6c76e5-74f2-4b2b-ac99-6ff29ca64816", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648028, "uuid": "7eb09307-444c-44b5-b1b4-66db78c68b79", "value": "12288:auZM4e/ZUdtbH6eYZIkiNriFOjJ5EEo0UMEgSAs5i9xL5ugV/YPcAoNB:auNeBUdtueYlF0aEXUMEgHnL5ugV/eM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623648028, "uuid": "29cad288-12b1-4baa-85b5-fab984dd008a", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623648028, "uuid": "a907d111-f9e8-459e-9e86-561a26443040", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648028, "uuid": "a420ac3a-1013-4e13-b281-3effd329058f", "value": "proforma Invoice, 14-06-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086908bc-ccd0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647943, "uuid": "0095ca71-059d-435e-9084-b5d536d69a56", "comment": "Malware payload (AgentTesla)", "value": "73da18cdf16d2e02a8972ea9536e82b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647943, "uuid": "2bec47ad-761e-4487-a35d-20c24c84c3a0", "comment": "Malware payload (AgentTesla)", "value": "38086a6e1be25a5b4dcd1aa8d5e1b9a2025d7b2b3db254551035cd25703e4e88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647943, "uuid": "1a96d8a9-90f9-4a38-9f2a-83f7351d832e", "comment": "Malware payload (AgentTesla)", "value": "5956d509c6f5434edc27fdcef14d05a0de77940b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647943, "uuid": "ce5f0ab7-08da-481a-b1ab-70a61e149187", "comment": "Malware payload (AgentTesla)", "value": "568a6c7e2d7f477c94352b10e025568920f3307c2ea0e175b5de77960199fed3cb58ce3fe320705eac017db73b531afe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647943, "uuid": "df9773bc-9651-4b55-b803-d4840c1b6acd", "value": "7B81E828877D0803CF07D0F1D538FE6903D6F61686CB06A6B37CF9B10B5BB61622A540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647943, "uuid": "a79c53de-a8cb-406d-851d-462e38805edf", "value": "96:RWPEJ9GpDxiIJKiGMsevwh3bgdGpM4rE9M9:RWMsiIJ6MsevwVbWGu4A69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647943, "uuid": "eee9a4e4-9db5-42f2-b9f6-4ea0c48b6949", "value": 3900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647943, "uuid": "5303fdc2-c462-47ae-b09d-93f3082e8020", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647943, "uuid": "23a891df-26bf-462a-99c7-066eea1c7999", "value": "Order Enquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c81d0d-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623651836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651836, "uuid": "2010b886-cec0-4ddf-bd43-ab53ca3181b2", "comment": "Malware payload (Gafgyt)", "value": "c2f5b1815aabf0b7d6b74963747867b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651836, "uuid": "d66550ab-9d73-44b4-8a37-146e247720fd", "comment": "Malware payload (Gafgyt)", "value": "39201025773ea9d325a7320faf3286d6d19e64cf6e0a74606c2ad3289e4950d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651836, "uuid": "15170d19-0d90-4d3b-ab65-4556fffccd67", "comment": "Malware payload (Gafgyt)", "value": "945ff8cdbecd2b205e2bf2183cdc1796dbe137b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651836, "uuid": "0af9dc66-450e-41b8-99ff-f33cb9bff779", "comment": "Malware payload (Gafgyt)", "value": "dc64d4426b0f7682fa7488763e00abd1be714db3494674c3e01caeb4df3318bec6d2a0d61e04570997994ebde9c60e4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651836, "uuid": "81e5a897-78a7-4403-9ff0-bed3f6214980", "value": "07B33A57671C0B43C58B5AF52C7737F187ADEA7112E221C5E40EBF801B72A701A26FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651836, "uuid": "7805fad8-ea95-49c9-9609-b11c2f380770", "value": "3072:FHXfEEPOH0UHNzONBbsQy5h7z7ku62QnI0PDG4gQNcR:F3LRUHNzOwQy5h7zQ2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651836, "uuid": "03ea06a3-4423-4197-9f4a-37488310e406", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651836, "uuid": "e384416a-687a-43f4-8b85-5861197e9167", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651836, "uuid": "bd818817-c463-40bb-a32a-9be42567a9c4", "value": "c2f5b1815aabf0b7d6b74963747867b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd22dcb-cd0d-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623674396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674396, "uuid": "b0cd3b30-0881-41ba-9d64-fe9e20826ac1", "comment": "Malware payload (GuLoader)", "value": "8d19e1e8974a87723730325f7c26231a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674396, "uuid": "30bddd86-269d-4cc1-a80c-dd20319f9a5a", "comment": "Malware payload (GuLoader)", "value": "396aae05856753674c211cb8e64462ffb4fb46a0a9238214cb39c12d0682ef66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674396, "uuid": "de47cc3f-1e45-410f-8a51-2703f4170f93", "comment": "Malware payload (GuLoader)", "value": "95fa1bcf3551902fc9e53cc2c94ffaa0145d3f4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674396, "uuid": "956dfef1-4bc1-4891-8eae-9dbbea55475a", "comment": "Malware payload (GuLoader)", "value": "c4ace7d9763ac660fa3c7718d2fd3c8376153269ed2e96b1eaa9c839432bf8991c0e8a78203800aa2a2d1ad109369ee2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674396, "uuid": "2a8d1a55-b0e8-4e9d-bf59-b73a3d1a3f01", "value": "F4143B16E303A426D661C0B1FC09E2FEB4142F766CA78D57B2F4BB566470DE368F8606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674396, "uuid": "2d90b981-84cd-48f3-9c07-aae06b9fe7ea", "value": "51114cc98630aad2088aa48f6e7a2e19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674396, "uuid": "6bd0ecec-e8c7-4178-b117-9914dd23ee5c", "value": "3072:ZS6O7R551JLaKgC9tirczIAwDKBVrNSSdgSlvpnjZSdR2SpMJAHzQfrw7zh4APeK:U/1JLaKVutAiQVRSSdgSlvpnjZSdR2SP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623674396, "uuid": "7227f4b9-2562-4c7c-b511-78c1af7f8477", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623674396, "uuid": "260e9baa-8583-40f8-adfa-7f0a7b955ea9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674396, "uuid": "59918722-b06b-4612-b90a-e28eba08f9ea", "value": "8d19e1e8974a87723730325f7c26231a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e912952-cd07-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623671763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671763, "uuid": "9ced02b0-1066-46b8-8503-645e262cbb71", "comment": "Malware payload (AgentTesla)", "value": "e9df0f25113a0923c67ddb7255d7be98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671763, "uuid": "9801e48e-283c-4849-8332-d4089847ca0a", "comment": "Malware payload (AgentTesla)", "value": "39ba79013e69a70e1b579728e1b0333ac3d4f36c6eff70b0019c6a5601422a70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671763, "uuid": "61cff44a-15b9-48d7-a84b-381174c3d59f", "comment": "Malware payload (AgentTesla)", "value": "5bd555b2ae5fe4217a7df53bba64110184804c6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671763, "uuid": "703c5a63-a4e6-404b-a4da-ffc78f8c4dd5", "comment": "Malware payload (AgentTesla)", "value": "87524428703c7173e3d590f75377a26b99e02e79b1bde419799fee53e7239eabb145656c432a2708b64bb24c6fa41bbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671763, "uuid": "861c60ed-2152-4009-8e27-6323a1b8233b", "value": "CB05E12523C88B92E67E4734D165418093F5FD1BD329EBDCBE9A14CC0BA0F818766B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671763, "uuid": "4c3560ea-9568-4231-8d93-64612721794d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671763, "uuid": "9302a3eb-4452-4b69-9582-6f3b47cf0178", "value": "12288:j6epDaTLMvjJPcDatX88ZgyJSz85AgxYLUYPUDqUJt2QCPJh/9VCZ6v:DpGTLMqDamWSzKRucRSLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671763, "uuid": "b428ca8b-8339-4b9c-9742-f1808abb943b", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671763, "uuid": "270093da-e1a7-41c5-a591-f9f0133c9474", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671763, "uuid": "d851b650-6426-4a28-a017-40bad19a473f", "value": "SugVz0cZPXagh2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c659255c-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623650838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650838, "uuid": "cd6eff5c-0bbf-4f44-9e8f-eae2e1c19989", "comment": "Malware payload", "value": "985547e134d3884d7623d3be63be79b4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650838, "uuid": "6830b85f-0c04-4979-9c72-b37ca422c52c", "comment": "Malware payload", "value": "3a2042b2d6223fd9466cfa2d51ba0af56b4df776aa9a2a5af0d05ccf97509792", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650838, "uuid": "57b77c5e-661d-410b-af17-8f8563369cc7", "comment": "Malware payload", "value": "f92105f790c1c91697edc79b796d592f4c380c92", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650838, "uuid": "657d7464-2ab4-4d93-b86e-5da94178eea0", "comment": "Malware payload", "value": "c1f8bcd4e74b23f7ca01350c15f52e06e5531ce88c51c7293217b79bb9cda7a30214f7a6fd11b7c46c36a23d5f7811c5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650838, "uuid": "9313cd6f-30a3-4acf-ad18-848b858185f3", "value": "88B4238B4A920965C7468672410F4813E1F8C32B1D85C68F77B1B5B80CF3DE8AD9ED6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650838, "uuid": "9bde064e-44bc-46a5-aeb4-f276ae7d7427", "value": "12288:gLx5FLpvr2iwaCeZue5f0cPiGbN+yBmM7bKvgejAYjspk8o:gLpD2vheZue5jXzBXavgGAcsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650838, "uuid": "1f6553de-5338-4974-aa49-7185024522c9", "value": 496195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650838, "uuid": "dcba2eb7-44f5-4246-b358-6bcd7a0d147f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650838, "uuid": "1c65014c-b318-476c-b11d-fd450e86abe5", "value": "DHL SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd7a40d-cd23-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1623683925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683925, "uuid": "38028c5f-fc7d-41a7-a057-68291f0bf062", "comment": "Malware payload (Gozi)", "value": "14549a6ccc41deaf7ccf9abd4c5ae61a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683925, "uuid": "77ef3a9c-ebf2-4c81-bb6f-115ca17bac10", "comment": "Malware payload (Gozi)", "value": "3aa3a80a403194be781482d4c954adc4ebd773cfd1fa008c2072c591b4bb5c5f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683925, "uuid": "c787a37f-49d3-4c34-860a-ffd237bcc76c", "comment": "Malware payload (Gozi)", "value": "0d0e546d80f324b9fc024e7bf4850455647c31d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683925, "uuid": "be2590b1-d35a-47a5-a6cf-510afddd0246", "comment": "Malware payload (Gozi)", "value": "19ee436147548d66a30af0fef31fec8605294cb0793434c414569b30c3dc23a1a9e745d2ff92a7d412751036c7b3c29c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683925, "uuid": "0732ad19-1b54-4c24-aa21-b143eee589fe", "value": "2DD4CE017580C032C57529368E64E3F10B7DBE648F649ACF37C82E7F6F74A92962572A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683925, "uuid": "4e6e07bd-62d9-4c7a-a95a-b408d7c42060", "value": "1bf03a2f0c3f791c6d4615af85585b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683925, "uuid": "5f5162c6-f91c-4f32-af04-99489d8ca02e", "value": "12288:rd4keA4P2oZNZZ9xf/5gqNT+ZSzojPeb6NAFYAqhVIdnBOciMajGVeR61:p4/VZNZZ15zojPrNWRQ0BOciMzQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623683925, "uuid": "1d3be22c-26dd-4454-94a7-b99bc3a32770", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623683925, "uuid": "760a8a79-aa22-4441-9388-c379d9f0cf64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683925, "uuid": "6e058a42-6618-449d-96f8-04d12aa26541", "value": "globalCounter.jpg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de930edb-cd3d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623695117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695117, "uuid": "a6eb7c72-b1e5-4a37-bfbc-faddfa1ad38a", "comment": "Malware payload", "value": "2d8f585a8b38b86f03ebcc44cc2dbe55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695117, "uuid": "3a734b63-1f4b-4cfc-ab01-6bb4d983f003", "comment": "Malware payload", "value": "3abd02986f8eb76134fd0aec2c23c41529df2573bd3cb29e858001c355a8212b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695117, "uuid": "957ab2e7-5e5d-49f7-b9df-2eb19e45859d", "comment": "Malware payload", "value": "efab682e4bdd5b9d9d7935db3a286835e1f9d9db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695117, "uuid": "4d19ff2d-ca96-446a-a407-8b9e8706fe97", "comment": "Malware payload", "value": "c51a02aa50d67e90cd7ff8bacf35fd9819146ac2ef35affcf419bb8aa73841592a7d82a7d291db6fe802b3c790d5c065", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695117, "uuid": "3f9f992a-28b2-4f62-bc57-21ce903dd3dd", "value": "1125BF534ECF866AD2684DB66B31EC8781325CA92948B3223EC0717DD9375EED8DF502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695117, "uuid": "633b0cb9-797c-4374-b07d-f75da47543e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695117, "uuid": "21623a26-82cb-4a1c-8fce-d228783ca735", "value": "12288:cTrSMPQipP5lrsNrun6oGiXEI4C7eKpzjMjPbt6TCjVrT52QnAUB1A2oWm:0GiprsZm6Z6La3jzkmNT5rDAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623695117, "uuid": "0e58db8f-1100-4053-8a04-8cfa0a70409b", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623695117, "uuid": "5a8d69de-7bb9-4df4-9108-ac3466fb41ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695117, "uuid": "610c0765-1c07-41dd-b8a6-eaaeb203b588", "value": "6ahDw2sIZ94DFXV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0072a886-ccdb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623652654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652654, "uuid": "255d302d-e1f8-4637-b8df-20e2a734b452", "comment": "Malware payload (AgentTesla)", "value": "c5deb6ae2380cff6f7845b765923f02c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652654, "uuid": "f036795d-ec09-445b-a3ae-cdb37d0bd5c4", "comment": "Malware payload (AgentTesla)", "value": "3d21603ce9082914405c37f775150a30cb44f6e53e7bf35cb78dfeda36c1e8c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652654, "uuid": "ca97cb2f-1a5f-40e2-a425-39a31b1c4049", "comment": "Malware payload (AgentTesla)", "value": "d1ab706407c6aaa3de10965ed85bb8f6ebf18734", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652654, "uuid": "818c5a5d-9b73-4e67-97dc-332b256b4bbc", "comment": "Malware payload (AgentTesla)", "value": "aadd93b43cec4ff3c7912b280b1845079327e9aea16545a2f5fee0b635dc006434350177bdf0a8648ed510309408889d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652654, "uuid": "d5aea06c-fc1a-47cb-9c33-24a6b21c6e19", "value": "21358C01B3D43A9BE43EE2366529D56881F5AE17A532DA5F3DC4B8DB21F2F024312763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652654, "uuid": "13d82336-48d9-44d7-96da-72fbf6fa0639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652654, "uuid": "32ec22df-dbf7-467b-9342-a51acd46dc81", "value": "24576:PNK6UVYtXiZeEHbHJ9xtT+RoFLdb7EUs2:9UYtXiZeE9LtTjLV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652654, "uuid": "9abf80c2-11c0-45d7-8a55-4e34286c7ced", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652654, "uuid": "8891efca-19a4-465f-a25c-94b3501acc2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652654, "uuid": "ef43c648-7bda-479f-a136-cb2d2601201a", "value": "PO New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce11d9d-ccd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623651306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651306, "uuid": "aff0100c-6489-445f-a37c-12b91d749ef9", "comment": "Malware payload (Formbook)", "value": "34dc53a99c31fa46571a5ed4ce401299", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651306, "uuid": "ceecfd6e-555a-44e6-9605-1fad48ee89aa", "comment": "Malware payload (Formbook)", "value": "3e270dfe8e2f4561ffa79fe24e3d935f453653866faf9a3d8c88231692f153d1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651306, "uuid": "b7fdaebc-8a61-4b0d-8694-43e69479904e", "comment": "Malware payload (Formbook)", "value": "91ef7139faa3228ee3e8b10c56f38e26285cad00", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651306, "uuid": "26a7070c-b84e-4a64-90a4-8398f62ff24e", "comment": "Malware payload (Formbook)", "value": "ac9038005deea1a1487558929b0bc6dff916b191245aee9caff8402b9b1a836595183f4ad2d3d6df1b896f182587307d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651306, "uuid": "7b489bf3-1ead-453e-9703-e3d1b3ef7540", "value": "87659A0DA0BB5A52D3CBD5F0B6AFB30C566DB84D21C804594825C5ED7CE4CE9C7A8CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651306, "uuid": "ba413e43-be90-4c25-8c35-60900caa91dd", "value": "1536:lqy0Tyg+fffffffffdRffNf6Eq+OkKiDtf6zrQykZr6Eq+OkKiDtfffOfPfff6zd:FJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651306, "uuid": "88418be5-8a79-4000-b4ae-6a1da30f0dcc", "value": 1458253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651306, "uuid": "4d14c2fd-4b50-4010-af2b-6a35ff8433cb", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651306, "uuid": "43f8a90e-fb61-40aa-8801-e17e79d59185", "value": "Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd786ebf-cccd-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623647012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647012, "uuid": "617f7d00-670a-4a9c-8da1-e4f8820b1b66", "comment": "Malware payload (SnakeKeylogger)", "value": "f85df6866364aeb21db4c80f4f99bde1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647012, "uuid": "14726b25-1c39-4334-9238-d9d572117402", "comment": "Malware payload (SnakeKeylogger)", "value": "3f2779d20014902628cfe7d01cd12cfec336d9d858aaa04b06148e7b998b379a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647012, "uuid": "7c3ee967-7487-407b-8473-51f45132e388", "comment": "Malware payload (SnakeKeylogger)", "value": "5163f6efe92b4a033833b443ee67a8df65c50f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647012, "uuid": "2c2cd929-7335-4ca0-a9f9-ca588575496f", "comment": "Malware payload (SnakeKeylogger)", "value": "106cf36a9accdee299e7adec45e21bb66243b22254a9f44554aff8bf7dcbf222496634257ec0012884c129846c3c685a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647012, "uuid": "c963e6b3-b145-45cf-8e33-5d1b5c3c74c6", "value": "8005E02132886F64D1BE6B7A8672550093F7B917C731D64D3FAD608D2B23F809B72B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647012, "uuid": "70ac3d29-ada1-44ea-88a4-aab14c2228a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647012, "uuid": "906fc0d2-e6f6-4425-8cca-ae94df43f3c1", "value": "12288:FN2zcWCh/t6gVqbUfchbA5vowadMHAB9poHr/YLwHDsoN+3JSlvnn2ZM4e/ZUdtb:F5H16EIUOyh8xkHrJaSENeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647012, "uuid": "6d66b2e0-c7d5-4516-a7c3-4a658e58456c", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647012, "uuid": "dd58e925-72d4-4ab4-836f-7dfc63ad8fd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647012, "uuid": "dc9d8a7e-a5f0-44f8-a763-5d669dc4c50c", "value": "Bank Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97d0f30-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623650897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650897, "uuid": "454a0253-5d2d-41f6-818f-a49cf4d23b39", "comment": "Malware payload (AgentTesla)", "value": "39be0811584f3ca4819c8eb94a3e14e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650897, "uuid": "64d0e71d-2361-40c7-bab9-2d2a7fef8680", "comment": "Malware payload (AgentTesla)", "value": "3f5e68adca11035f620635c1ba8f5321450075df5864cc5f792e7b21d8f473ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650897, "uuid": "76bbdda8-150c-4860-b124-68b13056f353", "comment": "Malware payload (AgentTesla)", "value": "7c7cb3fea637261b5edbacc13c5be2852a7a9a6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650897, "uuid": "7b8dae50-6b44-4b47-8bfa-ccfecf57d1f9", "comment": "Malware payload (AgentTesla)", "value": "dd38515526f05b623c0c079d30db1139ed29056cb7bf6446f5465f3698b313b5d928fa328fce38aa99b075ae408139fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650897, "uuid": "0c43ab70-ed4f-4cc1-b125-cf39a8598314", "value": "F1F4D03552888E14E17F9335E0B1550443F0F907D352EA4EFED858DA2EA27C2A3AF667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650897, "uuid": "026bead4-70f5-46f2-b661-cf1f21b2aaef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650897, "uuid": "9a84ac40-732f-4109-bea0-8fbc72f73fef", "value": "12288:uHlwx15tePvHf0EMPQdlMV40JO36Gf+XSNs6ENMKPUyeBxD9y4OEQmjGk:up4PQdUk1wgs6ENdPUjBxD6EHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650897, "uuid": "b1b81276-4f0a-4aef-b45f-3fe131ed6699", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650897, "uuid": "f32e746e-f4fb-44b1-8185-fb47180b7b79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650897, "uuid": "b2ed9770-26d0-4e05-ac49-8b910a7eabc9", "value": "DHL001173982010PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3951f1f3-ccd0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623648025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648025, "uuid": "e5a21d53-eda8-477a-bd9e-35d344ad4adc", "comment": "Malware payload (AgentTesla)", "value": "fcd3ebaa7306b28ec112a08bac6a32be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648025, "uuid": "97866b9b-7368-47fb-aed3-d27d7c1b8d89", "comment": "Malware payload (AgentTesla)", "value": "3f8ee48e117cfcc67443dbcfb0f1ce85ccdc5f06975298234b40e0115224661b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648025, "uuid": "169bd501-54a4-46c4-8f90-b386fb3f8d88", "comment": "Malware payload (AgentTesla)", "value": "d71c73945a65350c63d4f045f77a227088f255b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648025, "uuid": "28418a51-c4b4-4754-aaa6-02e87a163a37", "comment": "Malware payload (AgentTesla)", "value": "8a9b3d8ff5b9b645934004db3084953a1608d36c3ae873ad74b3f318ca2ad1c009a7ade18db56327a64ba98e19aaaaf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648025, "uuid": "86d8081f-b005-42fd-a586-6483390af52b", "value": "2C34235A8E6436EB26819CFF93914895804BF4BAD6337B33CED03E670F6D2A085D0A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648025, "uuid": "e7b4ce6a-b9b1-49a4-8c1d-ba2f18c36f51", "value": "6144:Qm+TPRANnaI1MZ++BhceAxFHwO3nSNv48MahgzfZPu:Qm+1rQMU0+wO3SBpbh6fZPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623648025, "uuid": "7203fb0f-3b52-4602-8892-eab570e2d92f", "value": 235523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623648025, "uuid": "a047d9c4-680f-4baf-ab5e-8ff6c318d531", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648025, "uuid": "b9aebe22-8042-4357-8277-e4b99671bff1", "value": "IMG_003_166_372.R01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f580a0b-ccd5-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623650290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650290, "uuid": "48e9102f-6519-4d92-a96a-6af4f83ba748", "comment": "Malware payload (SnakeKeylogger)", "value": "2b6f45a015b3b17834ebe4bbf1c8e173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650290, "uuid": "fc86516f-ebef-4f44-a21d-ea3bff97f2d9", "comment": "Malware payload (SnakeKeylogger)", "value": "3f983e49eeec11e4cb6604f62137725cefa23d53ac38e54edb8ca899e9570ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650290, "uuid": "6a7957f0-ea5f-4077-8d2a-7f1bda214313", "comment": "Malware payload (SnakeKeylogger)", "value": "9eedf4071c6c17329fa9b19bbfdb194affd9ea37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650290, "uuid": "8c2622bf-7b4e-40d1-bd1f-a1be1425f421", "comment": "Malware payload (SnakeKeylogger)", "value": "2ae18c83647bc2c48f3740f4cdc00ae5281a38b2f9810cb9f6f26491117a831a4efb7e3edc47a3fda71167728c8d599c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650290, "uuid": "4e281089-04bf-4adb-a6a8-f63e351eb6bd", "value": "AC25D025B7588F54F03FA37E8075D02423F2F91AA326C94D7DE526AD086378281B7E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650290, "uuid": "16183f2a-c646-4924-b59a-a71445f86141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650290, "uuid": "68577c1f-d980-4a6e-9254-dfa1bbe8a643", "value": "12288:bQibXqxYM9iIfFKfffhjokGhmtNLTfEbuszw28aD9e3ZD6Oy/cIpjt51YOvTl3OZ:V2ctNadB9e3ZDZyRjZBOuNeBUdtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650290, "uuid": "370d0fd1-79ad-4a85-8aa3-7d0b0c678ced", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650290, "uuid": "736bdf32-2363-4211-90f7-65f60b56d929", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650290, "uuid": "340ab9ff-5cc1-4115-ac4a-9f3b77571f34", "value": "pago,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36fdb61-ccde-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623654243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654243, "uuid": "d8e75331-9497-4b94-b750-c0ba57d0eb3f", "comment": "Malware payload (Formbook)", "value": "2f79c705d955da82dee19e7877b6d727", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654243, "uuid": "8de6a070-1027-472f-821e-aca5f9c7a728", "comment": "Malware payload (Formbook)", "value": "415d57e1f09267a12665f3948c174553443b0a9c442d9ca71efcbcd45e14d9d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654243, "uuid": "e4fec049-9bf2-459f-9c23-ff45df92d50b", "comment": "Malware payload (Formbook)", "value": "780bd5e728f6cea47df415c03eae7c88c8188b45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654243, "uuid": "06fa4887-ae29-4019-91ab-401fa42a3789", "comment": "Malware payload (Formbook)", "value": "cf39cfae1fdcd71119b9055ca865153446ce71e133ff3ff1b8c7529f181e2bc851e6ed30d915662d1e324916a4986c66", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654243, "uuid": "ac4d6052-2dca-4a6f-8fbc-3d2eadb59abf", "value": "4471862313D4C0F0E01C2A355AE3874DE438B0605B67462427B0782F28B73056ABE711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654243, "uuid": "60509b4d-b432-407b-9d0e-56c974681fcd", "value": "73bcdf876ec26f3d66df7a3f8dba4b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654243, "uuid": "b96f85f3-f13d-47fa-b3e7-3c4ceacb3985", "value": "24:ZHGStQ9Uvt1HXdS2c5lTW3lcO8Vy9xqDWSu0MRvrBL/Akqu:ZvtKUbHN1r3lcpVy9xqvivrBLzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654243, "uuid": "c70a9f42-7008-4995-a3c0-970645e1083d", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654243, "uuid": "7da8ff0e-ec2d-411e-9d6b-bc1e6d7a7bb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654243, "uuid": "16a4bb5b-2b98-400f-9f11-53080b5f44a5", "value": "New_Order.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b84b9d-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623650708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650708, "uuid": "70e6604a-57e0-4e14-831f-f1ffb188df80", "comment": "Malware payload (Formbook)", "value": "bdc23313284ed521f0e5523e79a46452", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650708, "uuid": "9b1b4f33-478b-4143-996d-e70680e48891", "comment": "Malware payload (Formbook)", "value": "41fb70f36b56d60a096ac2a89d7d9d2e6c75cf7725a75fd93ffebfcaabcb8e04", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650708, "uuid": "527fecaa-deca-430a-8e26-de6fcb95cf33", "comment": "Malware payload (Formbook)", "value": "ad5fa359595086f7b392d076d0bb2484953ad698", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650708, "uuid": "ff340204-e53f-4025-8abe-a319f572179e", "comment": "Malware payload (Formbook)", "value": "a2cf2298c6519a86974bb98ea8d58d03968ec7d44be8ee468275805375ba1b314c7a54ca33652f41ace2b5600ce5ee39", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650708, "uuid": "3d0fb14a-0e8a-4784-87b2-1c5137a757ba", "value": "C371666213F0C0F1D15827711D939709D57AB2A0EB7667343BA07A1F2C7B551287DB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650708, "uuid": "983b3cb1-1b6c-4ea1-b3d5-62cb77666075", "value": "d4e6ea9ec0efe39b1cb7664384899294", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650708, "uuid": "804c6573-9377-427e-a993-e14403045b06", "value": "24:ZHGStJAqf6vt3XkDyv30NP7HHAW5loW9xqDWSHMRvrBL/AkS:ZvtJz6lq23ePj5loW9xqvwvrBLzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650708, "uuid": "5ec67556-43f2-4a35-9c05-5fe1885e3e07", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650708, "uuid": "2516cd12-9019-4de3-8e8b-6a1311310c5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650708, "uuid": "20a69c43-6593-4bdd-8c7c-c509e0148ee3", "value": "PO36782110.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dfc0cf-cd0d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623674133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674133, "uuid": "b66fe8c7-4284-4bbd-b398-8145441a40e3", "comment": "Malware payload", "value": "e681f580f76279e4bd4b5cdbf0b90787", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674133, "uuid": "df0d5c82-a4a7-4a6a-919e-ea1559567783", "comment": "Malware payload", "value": "424294270456402b218aef56ae34693622efb4f70861578c6114869a975f3743", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674133, "uuid": "7256bb07-5016-45df-a9e7-2e970d455796", "comment": "Malware payload", "value": "21f1b18e94eeb7c566af3c843540ee31696f82d9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674133, "uuid": "e371c5f1-41ba-4a95-9303-94a073161743", "comment": "Malware payload", "value": "2389b883842520b3806b1353e634edce41eb1680e4fb796c4c481532738f323ea99750176a7a6e02868c680749bb388e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674133, "uuid": "00bb82fe-5661-4858-b46d-ae6abb04147b", "value": "1B741242B2A0F617D91BA235488BDBC23367ED463B4A834FA5047F5D7FB6F110A42B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674133, "uuid": "8734661c-1fcc-4bf6-8fcf-b35caa5e34ab", "value": "6144:Blhk5CDUJUMEUEl+8myYXxKiKz0jpQ+Wb4+2qREMmIEM1cNbeomCsJt4:BlhcQMEUElwvXxKDe2YqREMm1vRm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623674133, "uuid": "c40064e5-16f6-45c9-a8cd-0978b706ad03", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623674133, "uuid": "4eb72f73-f598-47b4-8f25-3db572e3d660", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674133, "uuid": "7be666a0-0dc5-40e2-bbc6-07786e2b87d9", "value": "IMG_0234010 (1).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347c73ce-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623653600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653600, "uuid": "43eb62c6-0529-4494-aeaa-2c89e6fcc23f", "comment": "Malware payload", "value": "d24773d80958bf06b022364e2b106b72", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653600, "uuid": "13fc2d31-419c-4469-bb89-19263529fbd8", "comment": "Malware payload", "value": "42fec03acfada29afcb81b7e989f1eee78831fd9ac06b95b4d8aadb819f7c91c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653600, "uuid": "14e1ed7b-2c76-4026-8f3b-2b2909065990", "comment": "Malware payload", "value": "aae1412bd6b4661fb6757eefe0f25ab2a800d1ae", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653600, "uuid": "632f3a1b-2ac2-463a-a6db-959af3facd7e", "comment": "Malware payload", "value": "3d446443a21ed70bd8e9e5096239e2d42925245a6fcac53b515b75c9e14d258df85797553d6ebc93d8318ccb54fb4754", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653600, "uuid": "95d1a08b-feb6-428d-bde4-5779f7f66d1f", "value": "EBD42378B335CB49C27DDCBA2672205C5EDE13AB87A0844468A91C9F493E7F10637DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653600, "uuid": "6efd93f9-fb6d-4a30-bfe1-5eae631dd74e", "value": "12288:PWBZ8WVz5oTy3Tvw0p9ehcjBLnK1oG5+0NTuzvjnhSvNphScVnD7:Eto/yehcjBTmoY+wTzNCM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653600, "uuid": "e63bfda3-0b33-4b9b-9a08-0c16878cf6ca", "value": 603153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653600, "uuid": "f71576f0-41b7-4601-9ac7-8ab79b7cce9f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653600, "uuid": "d3bfe410-9bb6-4f4d-8d13-690a800f0c98", "value": "Bestellung.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83bff9a-ccd7-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623651244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651244, "uuid": "356a2dfd-4220-4dff-9f5d-5aa73851300f", "comment": "Malware payload (GuLoader)", "value": "d7c368f0c65c2a8c565df3815e70ef9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651244, "uuid": "33469751-8a2f-486e-b053-dfc91d361e8b", "comment": "Malware payload (GuLoader)", "value": "439b1ce1850d9e816c22919cc13a412b9d1f00098486a642e97f34e7a62bd63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651244, "uuid": "e5ad16a7-eb4a-40c5-93ff-44935c49bbf1", "comment": "Malware payload (GuLoader)", "value": "0ff96bb6c163c9dfc6f5e42c4407347c947dcb6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651244, "uuid": "8bb61a93-871e-4593-9ec3-382c4986a281", "comment": "Malware payload (GuLoader)", "value": "64cc3ace4d281fffcf4cd60fb122fe2451ad8c2aa1d844f79ff0acc7685abf969a57f40a55f98c00281e8588c3919d74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651244, "uuid": "6264e341-6f93-4150-9d69-b206b298a48a", "value": "72146DA17B60D582F54B8474284EBAA5C27CB875114C8B27F881B3BCA43DBD2E60577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651244, "uuid": "cc3dc1ab-bdd4-4754-a72f-7efd193a9025", "value": "b2e3727c442d471988cc35e3702b319a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651244, "uuid": "b79363a6-703e-41f6-8bd0-90648766b37b", "value": "1536:JFNAAUuyxDi/795L+oJZzQwiVCw49lmWA6WWwdQxo:8ubh5LpJZzQRwxVWWwdQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651244, "uuid": "947f834c-7d0a-4e3b-b232-a5287d82af7c", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651244, "uuid": "cb49bb1d-03fc-4fda-824f-f57da80d1138", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651244, "uuid": "02d71816-2419-40cc-92f8-9ce6ba8af5c7", "value": "Pedido N\u00famero 4432003039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7850ced-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623654652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654652, "uuid": "39d32ed1-efe2-4f20-894f-35e909ead0d0", "comment": "Malware payload (AgentTesla)", "value": "145325f1ae6184668a66f18242cf7d55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654652, "uuid": "e6e0f137-8d54-481f-9122-939710ed550e", "comment": "Malware payload (AgentTesla)", "value": "43c39a2215e4edf97c394e80aab81777d2a91f7b72510b37cb36ae6277942ef4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654652, "uuid": "6d3cfae3-57ae-4f1a-9615-c888065dc547", "comment": "Malware payload (AgentTesla)", "value": "1eab1e7ddad2cad93f7a26c8c279bf6371b9bf8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654652, "uuid": "90983f19-4b77-4751-852d-ac69b0db1f2b", "comment": "Malware payload (AgentTesla)", "value": "7935c44519fd3626b91b94921955f3c085c0895fc4e57030f7071a4a50a014255489b2e1b69738795424b2a7388297b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654652, "uuid": "f2c5923b-07c9-42bd-86fe-df2552618aec", "value": "F4356DF0FD89B869C05ED730B25048FDD7A31EFA418A8B9D0AA7EDCD1B037498B58585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654652, "uuid": "b2415519-f133-4cd2-a408-054297806d32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654652, "uuid": "77f6b67c-50c6-4545-a8b2-9b4d43b75751", "value": "24576:koyYEa55hwTuL+f3ngAP6wjYPU32MavyNK6bACfLc:wYEa55hwTuLtkjYcxYYbdLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654652, "uuid": "feb9c122-d22d-4939-997f-1dcd8861c508", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654652, "uuid": "1a1fb867-2778-484f-a3fa-23b3c83811bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654652, "uuid": "cd7ad68e-989d-409b-9ccf-63b07f038a9f", "value": "P-06042021938874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62222523-cd0a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623673004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673004, "uuid": "6ff0c921-7b1e-4c2f-8ac8-f74928ddfeb9", "comment": "Malware payload (AgentTesla)", "value": "5959b93c1292430a2a1e9eca7ff8b526", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673004, "uuid": "04bf3c10-bb67-4c52-9e18-593f6d18eaf5", "comment": "Malware payload (AgentTesla)", "value": "43e378c04e0634ff031ad94a50974b1d524a6448d91f2a1fa9d9a6c56ea929ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673004, "uuid": "854c5cb7-40b1-428d-a1a7-e863b76afdbd", "comment": "Malware payload (AgentTesla)", "value": "b722c12e9730230ace4ea83bcd44eb9ec6187768", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673004, "uuid": "8bf9715d-2f45-4b68-9672-761dc4959c51", "comment": "Malware payload (AgentTesla)", "value": "a8b6c364c7f8fcfb54a24a988cd9cabacef69ec293818c20afacc27931a0d55438ce5d2ee26c76ab3e9b79cc8eb49616", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673004, "uuid": "27b66e1a-c286-4c12-b27b-27d5f2317842", "value": "F5D4DF7122C49B25D13CABBC5431448423F27E0BF352CB2E7DED71DD5E22B959A26B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673004, "uuid": "5c701f3f-9e79-40e5-8502-e6e149c8414c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673004, "uuid": "439f9f18-3e74-4006-899d-a065badb1034", "value": "6144:oQyKM2RG+zcwxOVbcEkX7oSCc0KDjryoiRWdT0UlWhfSH0dzzHocrAmMZ:v7M4GSYbcb83KDjWoiRvUeSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623673004, "uuid": "3a183410-212e-47e3-a0e0-8046a5d65d6f", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623673004, "uuid": "61010f6b-c268-4458-8d7c-d93c079c4e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673004, "uuid": "6d2f1d50-94f4-4217-b425-3f4b8670dd17", "value": "Proforma Invoice_DGS-21-1541 And Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91829873-ccd0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623648173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648173, "uuid": "1181e4db-4e28-4d5f-989c-5a66b630c35f", "comment": "Malware payload (Formbook)", "value": "d838b1bb5198cce282239ed4ed08de0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648173, "uuid": "5f6a1ccb-7667-467b-a9ac-8aa765e88068", "comment": "Malware payload (Formbook)", "value": "44328ff389f8b9fb0679290b9848395d930dd57cf30eb76d16af61289e6ba2c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648173, "uuid": "9c0bbf36-a550-4d92-b384-09070842beb4", "comment": "Malware payload (Formbook)", "value": "d4f7388bbd1710d4707c0400d0b60ae3d241d656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648173, "uuid": "6d2f9077-931d-4c89-8943-cf5ae4d2338a", "comment": "Malware payload (Formbook)", "value": "d18b9049b3e319af123e38782d361eba88cc50f6e15d3d65435f723015d72fafdfd59e9b29aa3af3d0d75e7c0894b95d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648173, "uuid": "52f8996f-6d55-4262-9277-73414813ce9e", "value": "F424125A22D09DE7F08D8AFC6ED5D374C772B30211205647DB584EEE6A322835E172EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648173, "uuid": "f66c0a2f-a5e7-4d90-95ca-aede4e3821f4", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648173, "uuid": "b8ed3d1e-b94f-4ae9-a741-140affbcdf79", "value": "6144:Ds9KXeL1jL4jWWCeNTh4XnenNJTIc/5eFff5d82i+:y66WbTh43enNJTn/5SQ2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623648173, "uuid": "76aa44a2-037f-4414-b1f7-5812407c4bc8", "value": 223597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623648173, "uuid": "8d658f15-74ca-4d76-9920-b109f5367b14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648173, "uuid": "a7ed7d9e-860c-4c86-9928-f6495335e8cb", "value": "UPS#SHIPMENT_CONFIRMATION_CBJ19051700013_11Z35Q6Q80446518864888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d1ba92-ccfb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623666727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623666727, "uuid": "13dd20b5-9bdd-44da-a694-fc99436cfc04", "comment": "Malware payload (AgentTesla)", "value": "e1188a527adfe407abeea3cc02baeba1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623666727, "uuid": "8c81b326-f36b-4cd6-bec3-74ade8ff6564", "comment": "Malware payload (AgentTesla)", "value": "4462cd4b81bbd30ae5fb46bada6435967e46dd76a231ec5a64c14009a0e74cb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623666727, "uuid": "4263a50f-a9d4-471a-9d3f-5a8c2857f1ec", "comment": "Malware payload (AgentTesla)", "value": "3f8c23a81dfbf55177b6e959b0202966110c90bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623666727, "uuid": "48d1dba5-b265-46b8-8765-234b2d27bd38", "comment": "Malware payload (AgentTesla)", "value": "a25a2b09e0b1c9d1a43865bcf9e4f02a21f2033e2a874cbcbc73601db87c897f666df534350645ddd1a4619275fd7cf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623666727, "uuid": "dc06da7f-519d-432c-a4a3-6a6750c07783", "value": "BD05E02623D8DB41EA7E47349265419083F1BD1BE329EBDDBD9954CC0EB0F81836279B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623666727, "uuid": "c1a32b98-f5bc-4a51-951f-76eb93f757c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623666727, "uuid": "1d377f2d-e926-457c-b7aa-9e0d9c38bc79", "value": "12288:fnZe9TaTLMFq7onO4YaZ6PYFK58Wvy/IJTkGt67GNTmT+k7d/9VCZ6v:f092TLMFMon/6PYbWKWT2GZmakh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623666727, "uuid": "b909c4b5-39e4-4a42-880f-c0e4fd19ff95", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623666727, "uuid": "c161adea-2442-4b94-b2ad-e44047ae17d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623666727, "uuid": "c9794352-3647-466f-9fe2-9d4b82f74c5e", "value": "Scanned Copy for our payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d950d5-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623654696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654696, "uuid": "444168fd-226d-43ca-beca-a53ffdb534b8", "comment": "Malware payload (Formbook)", "value": "f4cc912afc70561a8bae72295c0eb519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654696, "uuid": "9ffc6e0a-d3d3-4bae-b3d0-02da92317cc9", "comment": "Malware payload (Formbook)", "value": "448db9678085ca02c70d9011b3f1ec2d43aa6a8a65480ff77632b453c8c39617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654696, "uuid": "0730d643-0b48-40ec-8765-c10884908beb", "comment": "Malware payload (Formbook)", "value": "0525d0732322b20b584177b8f3e1c15aba9a371d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654696, "uuid": "18e152e9-c67e-4cc6-857b-c631362904c9", "comment": "Malware payload (Formbook)", "value": "ae6de7bb4a7afc9ec582b4ab16ee04f8e5d29745f4fbe4f64a590c34818db53594f8386830723a05af6c0b594255b9e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654696, "uuid": "966d0cde-983e-4066-91e8-e79137d544d8", "value": "EDB2F70813FC976BD6FE87BE18B2161017F1A3522922EB1CAEC570DF1A637518258B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654696, "uuid": "3859ef03-7da5-4fe4-a54e-6c5ddaabb9ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654696, "uuid": "d8f06b35-282d-4de3-b9e9-bec4d4392b0f", "value": "384:OvD5fFseVESLF2qi5FkSFfbU6ZKnJJiLhiixBaSVqbXZlH2FBR6W8rKIZGDL0YBB:Ob5lwKjizcb+FB4GvhBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654696, "uuid": "e495680b-6b7b-48a7-9eb6-ca3f8ab79d41", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654696, "uuid": "e516f8bc-5820-4d66-91cc-536ab669fd9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654696, "uuid": "add83ade-2521-48c6-975d-f669d5c3d2f3", "value": "StanleyUS_PO-3056882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedf6c66-ccd4-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623650020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650020, "uuid": "2496bf04-f986-435f-914a-ddae45b3015c", "comment": "Malware payload (SnakeKeylogger)", "value": "9c3e79c863d1529f591e73bf911b7096", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650020, "uuid": "a5e2f8c8-bfdf-4ff9-b967-04049b2b1c97", "comment": "Malware payload (SnakeKeylogger)", "value": "449e284968ff75bf5436ff0478e279dd2a9a705e56799663b48e6176f64bdc15", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650020, "uuid": "bb5b1f23-51b5-4527-ae47-48573fcf6486", "comment": "Malware payload (SnakeKeylogger)", "value": "e3c5b2d224993b1d8221b450949738545bb6bcf0", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650020, "uuid": "2e09ae4b-8d4d-4cf3-b3a0-77a81461e38e", "comment": "Malware payload (SnakeKeylogger)", "value": "c2eea8d4335610ade6453581944347e4a06b17b0bd12923452f205039942d9f0c81315a68185071622210ca2be989754", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650020, "uuid": "755573ad-a2ea-49fb-83fc-a5f449e58fdc", "value": "067423E21788AF0E74886D27E85ADD672325D291D4F5EC4CE6BBF3BC91801C43A41E1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650020, "uuid": "74ec79fa-33d2-4bad-ab3e-2cf53d701f36", "value": "6144:T7zFZZuOt+WLfvFKwc7ulgpHZP7SmriJ4C8An7fJGRLWiN95V10zKLZgwj3Nn4bm:bUOZjk3kg19mmmQggHwzKLqwbN+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650020, "uuid": "4dec8d8e-848a-413e-98f0-5d624dd6427c", "value": 369543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650020, "uuid": "e2310e90-b546-41e8-ab90-7ac34c8af7b8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650020, "uuid": "555d822d-8f04-4e21-92d7-4850f0a46025", "value": "TNT INVOICE AND AWB.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfc66d7-cd5a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623707409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623707409, "uuid": "2fbcb79b-1315-4fd8-8f42-1be410646b5a", "comment": "Malware payload", "value": "755f6460de480381eb4e94768fe27c92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623707409, "uuid": "3e12d559-e395-41d8-bc19-352d9e3f9406", "comment": "Malware payload", "value": "4558ca0720eed3f8e2554006b53c896b3f6e57a1ab25e62f5914478f2b89e111", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623707409, "uuid": "7d41963c-0708-466c-a512-20aa805aba58", "comment": "Malware payload", "value": "fc10b67d68ba8f821b77432ef44f6b1761971765", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623707409, "uuid": "bd3ec927-1ea8-4b0e-9ad1-aa16d21c0035", "comment": "Malware payload", "value": "b4424c774f6446af7e7b40f0ededa5516ed5872c2c665c38281dabc95fab7012dd651f66a30d525ff05a1d2c54c572d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623707409, "uuid": "2877b8a0-d6e2-4f89-b79f-3d0794a8f10d", "value": "231412BFB3D4A9BBE94644701FAFFF6CD67A63081322150BA3885FAD2B143419716B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623707409, "uuid": "681e7c5b-2947-4b0a-9816-5cfa1be3ef22", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623707409, "uuid": "ed70ee0c-b055-4072-b5b5-9f78ca0c6d83", "value": "3072:cLk395hYXJ2MT4mZdWFeBr3gDcd9CtA375zPK0mpl5QqvfDjirQ5Qky2px7IVt:cQqJ0mZdWEBzdbC2rY0mpHRv7Naa+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623707409, "uuid": "4ee27e30-9a50-4891-87ee-b0451255649c", "value": 207690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623707409, "uuid": "e054c183-ab21-4e8f-bd63-5a0aae17be8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623707409, "uuid": "c04ae9a6-f716-4f7a-8611-05fff19c5b9b", "value": "755f6460de480381eb4e94768fe27c92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cdc46c-cd49-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1623700308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700308, "uuid": "36a693b7-87da-4687-a90d-125f64fb6dc4", "comment": "Malware payload (Gozi)", "value": "1d7e9bf93baba614a58c060d9a81d3b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700308, "uuid": "bc13cac3-fd6d-4bd3-b6a8-1571369de5d0", "comment": "Malware payload (Gozi)", "value": "45efeab42297dcbb8c90617857c3285d54300c42067d2d97a6b5c81c309608a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700308, "uuid": "7a0ed2ab-4dba-4cff-8eda-207236fcb432", "comment": "Malware payload (Gozi)", "value": "5a666b2783b939f7cbfd674356c6b33ffce13e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700308, "uuid": "436693e2-fbc2-45c7-9f1d-22376e7a3960", "comment": "Malware payload (Gozi)", "value": "16b6f1eb4d40a86095b6e54481ac96d5465dd8969c596c0eda3eb050663f44b4571fc42e246e3f3271a8bc13035b3eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700308, "uuid": "8cca8c54-54cd-4b60-822f-9f17522e2d2c", "value": "7983E70237ECAC44D1BD8AB97B3253C18779FC0A0613E61D4AC4606DA937757BE46BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700308, "uuid": "3d81ae71-36cf-4bda-860a-57d088fdd36c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700308, "uuid": "16276647-2852-4558-8c4c-c914d213511e", "value": "1536:tPvK/3zvzVZNCNkBllT9PjzJxuOmb54vHTL9Ne:tiFCNwpzVmb5uHv9Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623700308, "uuid": "cbad335f-41c6-4731-bf9f-94646a425720", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623700308, "uuid": "877d5947-95dd-46bf-b4d7-9204ab396784", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700308, "uuid": "2c7783c0-f9cd-4c59-b1c3-23b6cff39ec4", "value": "1D7E9BF93BABA614A58C060D9A81D3B0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec43d73-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623629431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629431, "uuid": "cc165318-4d26-4917-9e58-60baefed4912", "comment": "Malware payload", "value": "cd5da0b66319efbe346a4ac98df2f6d0", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629431, "uuid": "8769af96-169b-41ca-b410-75a5c67e8d5e", "comment": "Malware payload", "value": "46338cae732ee1664aac77d9dce57c4ff8666460c1a51bee49cae44c86e42df9", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629431, "uuid": "20bb8d2f-56eb-4eff-8f36-bdfb1e9573c0", "comment": "Malware payload", "value": "0471e1a214f458d4c478677ec9896b0f31207377", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629431, "uuid": "380b16cd-e1c8-42cb-8d85-78ba278f640c", "comment": "Malware payload", "value": "11f4a85382fd2ae9beb27769f666507669a27f8cb13a899437f78642b5089262bc6be9e869535583180ded42889dc103", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629431, "uuid": "072fba2d-c964-4e72-b9d2-a73e7c4b269b", "value": "76141809FB980D45E4434479BFEE33676A6A3A313204B497DF83AEC864FB85197A7407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629431, "uuid": "9deba847-779a-465f-af7a-062dbdf056f1", "value": "087085815138e1562fd1eb2331f3db82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629431, "uuid": "31553381-cea1-4f09-a27c-cfb176fcdf3f", "value": "3072:IEUqqEapZD/5KhAe9AdXR/OANFRRMCV8jhelN0z63oQWChI6:7nmpZs1wB2iRRMCV8wP0zBvCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629431, "uuid": "c7644ccc-5c89-4db3-ba0b-5b287f96d167", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629431, "uuid": "c8be4cce-f620-4cee-8cd6-2f39f45d60eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629431, "uuid": "42c78688-d7e9-4c70-a9d5-0b7134a68acf", "value": "46338cae732ee1664aac77d9dce57c4ff8666460c1a51bee49cae44c86e42df9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82db5b30-ccf1-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623662321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662321, "uuid": "21e1ecbe-f8a9-4abf-81fe-7fed5da27455", "comment": "Malware payload (AZORult)", "value": "688db49fed7e67ac094418e5d650ea6d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662321, "uuid": "ee011bf0-3160-40c9-a014-84f4320a617c", "comment": "Malware payload (AZORult)", "value": "46681ef5502ead8800d36880d4852494d4e5f93278b1b86a2165e8f0783ad4b8", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662321, "uuid": "b5b0fc11-b077-4012-abcc-d98c28556905", "comment": "Malware payload (AZORult)", "value": "8d3848973c1bcfc04bc8792269a019a3336ee22f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662321, "uuid": "5536f1c0-13c6-4bff-bb79-c47c1bc2feed", "comment": "Malware payload (AZORult)", "value": "c1f8a3a24789ba3d70ec0facb6fee244f11d573c0fcbf0a8217bae2b612f0075eff5ba31e9b222ba581193d275a0157d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662321, "uuid": "d9c5ff06-376e-4475-b8f1-b6d9204a57b9", "value": "C3659A0CA0BB5A52D3CBD5F0B6AFB30C566DB84D21C804594825C5ED7CE4CE9C7A9CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662321, "uuid": "e2705111-ff86-49c1-b092-e520f852cb95", "value": "1536:96ygHyU2777777777Mw77V7Kw62GQai317KnvEyQZvKw62GQai31777G7r777KnM:gJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623662321, "uuid": "01f00d19-436d-4b85-88e2-e79ecec95f9b", "value": 1458277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623662321, "uuid": "3a38e59e-3828-4a65-b5d9-64f38d76f146", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662321, "uuid": "d01b830e-5d72-4a1e-824b-5bac2e538b66", "value": "REQ-54265-CSE-445.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fc6662-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1623652240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652240, "uuid": "2c3b3a93-73ef-46c8-a1bb-97108de13626", "comment": "Malware payload (LimeRAT)", "value": "afa20e4eab3b40830a2f8fa5ab756b71", "object_relation": "md5", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652240, "uuid": "c0dae173-e5e7-415b-ad34-a81cc105d994", "comment": "Malware payload (LimeRAT)", "value": "4742544113612a92eda352db2826286ef7d8c2cb81d675c5bd9c3f058272c8ff", "object_relation": "sha256", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652240, "uuid": "94f731d8-7ff7-44b3-a7b1-63a5a3645461", "comment": "Malware payload (LimeRAT)", "value": "4ee60d9cf883fd46ffc1a1b60d802676b5d9b20b", "object_relation": "sha1", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652240, "uuid": "e7b67b8e-b3bb-4873-9157-f4f170a5a9a4", "comment": "Malware payload (LimeRAT)", "value": "f17bbbcb67f706fb05a4367eddff124d108416bc2b7c66eeee189dd6354c86089ec1078b610d113659e21cee666563e0", "object_relation": "sha3-384", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652240, "uuid": "6d4d0d5f-f8c3-49fb-9aff-af7c7a311bc1", "value": "EA5533289DD60786D587573A10D39D3E92BA8C11650EE61A370FFFE9BB341791BC2E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652240, "uuid": "50aec9ac-348d-4877-85d4-180889c00b50", "value": "24576:z2Ms8wbkrQhTiCM8uHbKCikAWRgjr1htEXRdhTXuvINj1Zld17YI1cOix:z3sao2C9u7vAWKxhGrRb1Zld1tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652240, "uuid": "ab4ee755-75f3-4ca9-9e93-c358091bf9db", "value": 1325568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652240, "uuid": "ed3a9d57-2e78-40ff-b53b-0b0f4c775251", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652240, "uuid": "fe840950-ddb7-4a36-a40f-8816d002db88", "value": "Policy reminder.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ece4a7d-ccb3-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623635632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635632, "uuid": "b80c9e1e-b6ad-4235-aa9b-09b5ae76a52e", "comment": "Malware payload (Gafgyt)", "value": "d595451dfd067e8acf47790a33bde7c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635632, "uuid": "8a10dba4-5927-43da-9d1d-8ec851d5e6bb", "comment": "Malware payload (Gafgyt)", "value": "476f15b268c7c6cc691a7d8222f5384834b678f65304bf0fbf87be7ac45c3120", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635632, "uuid": "8a07b814-81fe-4bd6-94c0-a4a3e23a725b", "comment": "Malware payload (Gafgyt)", "value": "6d91c116055546f9df094d1bf9bcc3bbdfa05618", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635632, "uuid": "4573fc69-f6b8-40b6-ab14-eb51d0705b64", "comment": "Malware payload (Gafgyt)", "value": "1a445fd3c126a66e2757f7382ea8b913f7259b51fccd39802a5564c9de5eefbf620935e4a6f730368a06c3c289974494", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635632, "uuid": "f2e8d26a-666f-4428-86c5-6f1c82bf7ac0", "value": "C3C30805FC404B27C7E237BAF79E438D773666586BD73311AA295EB02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635632, "uuid": "47f77e4a-2dde-4f9e-85c7-d144449f7fb4", "value": "3072:kJDZ+6lJQTnoo3XKxvnKgxzWE5hLSwuXE4P4eoC9DQlD6ObAF5R:MnK0iE5hLSwubhoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635632, "uuid": "4ddc45e5-7c99-4cb8-9231-1c2493f2c179", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635632, "uuid": "1427b132-9d3b-461c-9db1-7c4614f88eef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635632, "uuid": "870ced7b-42d5-4a22-9fed-fd24d8b0e2ff", "value": "d595451dfd067e8acf47790a33bde7c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3386590-ccb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623635344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635344, "uuid": "f76a836a-aaf1-4945-8996-9032dd5d0b37", "comment": "Malware payload (Gafgyt)", "value": "c18681f2267e9e53f5f75d1c42346276", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635344, "uuid": "01e3a79f-6960-4b69-ac4a-5384dc3f5daf", "comment": "Malware payload (Gafgyt)", "value": "4882e7b123516d24690195cb67f8e945ed008b44fee245c0aa785f7b2fa68683", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635344, "uuid": "5117cec5-4888-48f6-81ab-29d571bba620", "comment": "Malware payload (Gafgyt)", "value": "ae14dc4bc42d8fdec7ef8c5a8a2159a607ca1ac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635344, "uuid": "91e451b0-d888-4cdb-b3f4-a299f1467d96", "comment": "Malware payload (Gafgyt)", "value": "94175cf537151d9ea38be2d30872d37aeb6fb42817a4cae2defd599155e58501c03b144941e30079ec98d22f66683fc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635344, "uuid": "81e54d19-78ac-4fc6-b603-443f5cec8c64", "value": "E6B33A0798619F73C045ADB129BB5530072BBA120F4F1F99B57DAAB4074F8DEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635344, "uuid": "e5ac4282-bee4-4b1e-8382-af95882d8715", "value": "3072:+xT4TOOCY+Ygj0wn5hLw+VQDCkLkY0Px9gQNfR:+x0SRbewn5hLw+VQDvLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635344, "uuid": "2f6dcb7e-5f4c-4571-82bc-b7e913ac063e", "value": 108411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635344, "uuid": "461eb147-e907-448e-902f-63e03a8a7ae1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635344, "uuid": "5d921d0a-5b4d-48e3-af08-5bfcb362d40c", "value": "c18681f2267e9e53f5f75d1c42346276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bee0f9-cd06-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623671423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671423, "uuid": "6c11dea2-fccf-479a-9e3e-089a179049eb", "comment": "Malware payload (Formbook)", "value": "eb8e33e8486507c39c9b013b57cc1e71", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671423, "uuid": "24dab67a-b5c8-49b4-bce3-00f2f2c85390", "comment": "Malware payload (Formbook)", "value": "48ab4f08a4f3274184677a80cf273185b1797fa46ea92a47403291fdbfc3d249", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671423, "uuid": "974b5ab9-cd27-419a-8c03-0e2d197e726a", "comment": "Malware payload (Formbook)", "value": "1e95e56734a72e06e486a2bb5003a1aa968e889b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671423, "uuid": "999cc3cf-b7b9-4a96-aadd-e9c19f761a91", "comment": "Malware payload (Formbook)", "value": "467d474c19ea8cce6ac08ebf9c44a62e8da3ace6fb71a1c427d1b7e6f1aed7f7c1363a0583f4f396acb8d7fa18536802", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671423, "uuid": "c33b0e63-41de-495e-a0df-0980a7c5808c", "value": "C6452398F6A02F97DA0B1A3E18D7D6258EF88E50E76587CE2B487309F4347B1474326D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671423, "uuid": "bf34f67d-9ec2-469b-b490-3bcf5b647717", "value": "24576:g6WVeOVILLz79lLNztNzXeIzzHNvJ50E8onlELzax0MBzgq/zhUSNX4n:gUOiLP7/LRvzXtzzH1JjuLzxY0q/VUS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671423, "uuid": "cf6f9f85-a876-4edf-89bf-d85ec258b814", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671423, "uuid": "0814a7dd-dde5-4c80-81ae-5c47dd01b3d3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671423, "uuid": "4c5b56de-76b3-4ff1-836e-4eda45290f66", "value": "JUN14 OUTSTANDING CONTRACT ORDER-01.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c3e4b3-cd2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623688636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623688636, "uuid": "b661c59a-d204-426e-aa00-ec3f9493e860", "comment": "Malware payload", "value": "b8e1e5b832e5947f41fd6ae6ef6d09a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623688636, "uuid": "e812869b-8461-4ed4-bc29-a4002d16a1c2", "comment": "Malware payload", "value": "48d208b87b29d50bb160f336c94b681e232b0f90e8c02175e593d60737369c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623688636, "uuid": "0c6d0dab-a0ad-4470-831b-54278e312c7b", "comment": "Malware payload", "value": "a3ca8df5115ff13b75d21f2a475e8e60e5c9ed1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623688636, "uuid": "df0c2348-2bd7-4606-84e7-59f41236e1f9", "comment": "Malware payload", "value": "975afae3954e2159e046de109d333039f3ce665faac54765ee848eb12c39a9f182c9816a5eae6941edd680987f3d2163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623688636, "uuid": "b1d35023-5904-48c9-a959-7363522d7da9", "value": "4C348D33B8A18475C97E44756A8C5F29CAFDBD212074E973CB9834427AB4CD2D72B287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623688636, "uuid": "1e507f14-c868-4dc5-8db6-93d8004abfc8", "value": "5398a31c02f982d19bdfe5ec49d2e4ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623688636, "uuid": "ffde1268-92e1-408d-b999-7c08d48dc079", "value": "3072:YFlevheSnU3SOw9/WjiY0HQGT8DtUnbEocTP2M4A:YaZe1Xw9/XTmKbzcTOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623688636, "uuid": "ecf51e9e-48b8-4c97-9716-2765eeee43ff", "value": 231529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623688636, "uuid": "e0e6dc5f-6f3b-4720-85bd-ad4e48a76cd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623688636, "uuid": "ffeeaf0b-76b7-4da2-a894-ece0e7859a2e", "value": "48d208b87b29d50bb160f336c94b681e232b0f90e8c02175e593d60737369c13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb73a2b-cd07-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623671732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671732, "uuid": "ebe29b3b-419c-47cd-a168-acfea9bf18f5", "comment": "Malware payload (SnakeKeylogger)", "value": "bd400147292b30f4d1d242dade600733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671732, "uuid": "54b94867-4969-4f8b-a403-910d2c6c253d", "comment": "Malware payload (SnakeKeylogger)", "value": "4936937ef4d9776b90355ded4e1e4ddfa19cbe6aff9919c58ca3453efd3fc64c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671732, "uuid": "1a8a194f-6dd4-497e-8436-c17058696c81", "comment": "Malware payload (SnakeKeylogger)", "value": "4f5d2a6a43a349c84a6bfa1552cbd9c7fe86d18d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671732, "uuid": "aa1d5d41-c281-47bd-b791-5994b0608015", "comment": "Malware payload (SnakeKeylogger)", "value": "f7169ee788632e8798230cbe41a78fcfd4fa4b461cbaa7bfff9afdb9c3600abce1ee0cc18c05ad7a98d484f13446685a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671732, "uuid": "d492b09d-91eb-433e-93b6-f5baacfc096c", "value": "7825CF23B76A9761C9259E3F480F00C983E9954774F0E38FB4CD16E47E11E4EA79D82A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671732, "uuid": "300c2dff-fc6a-4c5c-a94f-fee6f422cffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671732, "uuid": "61af6f14-ea2e-4bb4-b6f8-a6e919356803", "value": "12288:ItGKXxXvM4GSYbcbkyx2DiAzYktHwKBZ:IwcfM4EEuiY2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671732, "uuid": "bac4de10-fc88-4444-acf9-083c4642bcdb", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671732, "uuid": "30e7788c-cd2d-4c62-bd2a-293e63332bbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671732, "uuid": "cc6bb1d2-c91e-4697-9768-6cea74440be5", "value": "Halkbank_Ekstre_202101406_080203_744632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ce59fb-ccde-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623654079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654079, "uuid": "b8e2146a-6ca5-4148-9a2c-63eefd2bf858", "comment": "Malware payload (SnakeKeylogger)", "value": "a620c7d3ea50445517d2bb2073bb570b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654079, "uuid": "0662c51e-c7b0-4ea8-aa2d-80ab45158c71", "comment": "Malware payload (SnakeKeylogger)", "value": "49eb1992f901c5ead8ff9bbd97a944c7652489c9b22356b989babb2a7b23ae73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654079, "uuid": "784d86ba-84fd-4265-830c-aceafe8cab39", "comment": "Malware payload (SnakeKeylogger)", "value": "e34755e6ab7635d158a7b6dc02c4649e2e5e22fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654079, "uuid": "80d00797-5244-471f-a116-473293768ee7", "comment": "Malware payload (SnakeKeylogger)", "value": "e0f81346759a9c2c3da4b47117ab7b8a2abccdf8738d09b9e98896b2913d7b733a587ace20467d603f0bc28577603eaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654079, "uuid": "37128bbe-0ce4-48f2-b369-f9963d2c82a6", "value": "053517F4F241D490F55E9671CE90BAF88622ADBECA070D1B06697ECD393775B4B3A042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654079, "uuid": "89780b31-a08c-405a-adaf-ee7fe6e5f6d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654079, "uuid": "9ec6c8bc-085f-4f19-b829-a76921945ad5", "value": "24576:7YEa5xhwTu1BSSEw3QcWOgU4NAqf4Eqo5h:7YEa5xhwTu1UpzOI7qon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654079, "uuid": "73881344-a2e1-4f13-9625-578c9bd98762", "value": 1154048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654079, "uuid": "cb2aa5bb-4103-4160-a29a-f694a9669d46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654079, "uuid": "47e218ac-877e-4611-a5a6-c4659c492050", "value": "GzI0cmjinWgHIN3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c01dae-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623650683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650683, "uuid": "ecbf091c-94ac-4fa3-a518-140e3c171038", "comment": "Malware payload (Formbook)", "value": "42703ab9f78e29fd6f93a42acbcf49c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650683, "uuid": "73a29097-4a7b-4d0b-beef-417475076913", "comment": "Malware payload (Formbook)", "value": "4a61d8e95d07174b85c8ac932c3b1a88b16941dc4a9c3ee84b338a9efd961418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650683, "uuid": "15f5d26c-19a6-4920-97df-a03774d06f0b", "comment": "Malware payload (Formbook)", "value": "b85726554494267955fa971e894e8fd9fa509fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650683, "uuid": "35d8791e-2af0-4a52-9851-f9eeee913121", "comment": "Malware payload (Formbook)", "value": "f752fb1ca54e7a715f3d38bc54761aeb8176ee66f88049ad105c18c0d25cc7a6aad8439ea55777066caeb7d6e3d2d9ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650683, "uuid": "d6240086-7179-4213-9042-a6eac56e7cd3", "value": "172422D537C0C91FE5841FF255F6EAB6DA796E4227612C1A8B382F77AD34281C4122C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650683, "uuid": "a2ca177d-591d-4852-9cf7-6205658be3a2", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650683, "uuid": "2f789886-1c2f-4704-8a1c-61c9735f2692", "value": "3072:DQIURTXJ+M8WpewYGNzttIykt8nVoVSWRIqEHeIv6RSytB473lzVKiTJ3c0N8RdJ:Ds98RwDNEOyoeIUBziTJ3cUsk/N6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650683, "uuid": "d2555fd7-3849-4bff-9be3-38d9a50918d7", "value": 224501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650683, "uuid": "fd9966b4-2576-4216-9a87-bff3c729cba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650683, "uuid": "d4e61e36-c7f6-4d06-84cd-ba50328b4470", "value": "PR#28201909R1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e490aeff-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623652177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652177, "uuid": "40d69c69-b10b-43f6-98ee-63487f514a77", "comment": "Malware payload (AgentTesla)", "value": "f182afb0fd6aadfa411f5352c2509b32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652177, "uuid": "d7701760-8bee-4ffa-929d-d5d7bd45563a", "comment": "Malware payload (AgentTesla)", "value": "4ab1111fe79b2eca390c4aa53b90cd1742b9d46a482b92db588dc17ad563b7aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652177, "uuid": "c7dad7a4-2727-4e61-b0bb-b512f25b529d", "comment": "Malware payload (AgentTesla)", "value": "8a84c4020c864f4a5ac486190282adaa58194d9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652177, "uuid": "66006228-6d3b-4e56-a7a4-d7e6091e896a", "comment": "Malware payload (AgentTesla)", "value": "2559b4cef45db5faded8d6e7e2cdb344aad872a3e15510154110a7140f17e2b789214f0431bd8ec49b7bf82cf49b7655", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652177, "uuid": "bec9de63-266c-4cf8-9ac2-d2da44bcd819", "value": "E691C874651C3A83E9978AB7C9C5FF2502B3F72A92CB4D80729DE9F1073B6612931845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652177, "uuid": "fd5a8c77-ce47-4984-b440-af3f5e9f04e0", "value": "96:OIpcvWBj+A1MdMTMFhCy9RCBhReqN6O3mFFN7dUjcjlTWFLMUnUd:Hhj+9h/khLuFFN5NIOaUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652177, "uuid": "1ad0cdab-906e-4930-93c7-f4667ae3c0e4", "value": 4347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652177, "uuid": "a2f54eaf-a56e-4999-80e9-20a9afdf137d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652177, "uuid": "0b078bdf-7af6-4b18-9efc-4efa88225e5b", "value": "PET FOOD.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cc8fbd-ccec-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623659993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659993, "uuid": "4a2d2ca6-2fff-49f1-9170-e58312450b64", "comment": "Malware payload (Formbook)", "value": "36fab3a442339e69ad9aa74d609d6153", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659993, "uuid": "cc2d93a4-65c8-4218-894c-5dd00960361f", "comment": "Malware payload (Formbook)", "value": "4ad218e760572a242d82691c7f3a9de510986d16c6345ec57090d19e9c45d6c7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659993, "uuid": "a3f669c1-921a-4ec9-85a1-f080816ab095", "comment": "Malware payload (Formbook)", "value": "13b8afd55baac466ec005b5fc5b0c5ad4fc1d85b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659993, "uuid": "384d81bc-a7ca-40fc-b00e-5dc79185966b", "comment": "Malware payload (Formbook)", "value": "73112adca4edde3ec381bb2cd71c734dc62697a2b0f15454d26fcbc42c472e494e82a8e145d44fa60e0ce8f56bb32e43", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659993, "uuid": "80e2c8ca-4e43-40b5-b170-628df9e5ca34", "value": "1AE423269F5EC68051C9F6F0B2F3A81B1AC1E8D7463047A353F245DBE6C40D6A2E770A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659993, "uuid": "5d566812-bb63-4b91-8135-9c53df688166", "value": "12288:kY63/LGOW33+U6deN3hIPsfneVkmEQjIht0ID8VOQ+c52zi0rug:kpDlWn+Udqsn+k1TsOQ+w2Trug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623659993, "uuid": "7e4a004b-724b-4370-8855-6c4c14133de6", "value": 701976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623659993, "uuid": "914eda83-9b78-48a1-8eab-6cb5e9c429cb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659993, "uuid": "174898b0-8e54-4dc7-b517-b0f0ff2687ab", "value": "Enquiry.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96dc632-cd21-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623683083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683083, "uuid": "b779cda4-3d44-4d81-abf3-758a89658cb1", "comment": "Malware payload", "value": "de52d28b9733efb3bc9907490637f8c3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683083, "uuid": "8f66e8cb-c013-4f97-b4cc-8476eefee74f", "comment": "Malware payload", "value": "4afdd41880118abd911a52d401ce30548f2455f0f71a3aeb23b79cb6e32d4901", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683083, "uuid": "182fd913-8c6a-4d0d-8788-af488b10a76c", "comment": "Malware payload", "value": "689afe882a80dfe407abc3cd60e2880df5f639e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683083, "uuid": "6ad2c364-0a0f-4fcc-93f3-c9d6993b9e6a", "comment": "Malware payload", "value": "205024654b4d80e3591020aae737e81a285998147eb80fb47ec1cfd1cf8f9e4e38ee861e926588b0deccb02c5d71f3f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683083, "uuid": "057e419c-41b4-4a09-95a7-0145298a0ada", "value": "D9640287FB22BC1FCA010FB125DB0B9976BC965B82C79091B3D0C95F35B6185B7A11C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683083, "uuid": "ae71ae9c-9d7c-4845-a296-1892ad41c03b", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioj3Q:p3lOYoaja8xzx/0wsxzSi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623683083, "uuid": "e00fbbc9-9f53-465b-bfa5-4f13a3722570", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623683083, "uuid": "a580ccdc-9066-46b8-bb66-efeeff3851c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683083, "uuid": "44317012-70ee-4738-a6dd-d0dd93a3b7e8", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ed9004-ccf5-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623663957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663957, "uuid": "97c86e23-5117-49f5-b864-d9ffd76c9cef", "comment": "Malware payload (SnakeKeylogger)", "value": "3d1a0f0479bb680a55ff4f18210e7250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663957, "uuid": "09bbd06a-f86b-4873-b89d-87e2b0d37b2b", "comment": "Malware payload (SnakeKeylogger)", "value": "4cb161fd7f4dcf4787be57b56dc94005c90f5ef8b3271c45d206bf91f67f7a8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663957, "uuid": "7c627f6e-3688-48d6-966d-7d3fba879d87", "comment": "Malware payload (SnakeKeylogger)", "value": "c19df46ce47530f5dd46e893442b596d67690b37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663957, "uuid": "7f6e1d3d-3a9e-40ec-9f90-a6ff26ecad62", "comment": "Malware payload (SnakeKeylogger)", "value": "5aa7d8e6c096add9a8e299fd4d8114c8b728b1522b91f011ac33ab2313d5cb51578463dfd44ff468b2775b96b884b837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663957, "uuid": "d23af601-145c-45c6-bc38-36c787192e79", "value": "F005F12A63D89B56E67E47348265418053F1F82BD326EFCDBD9914CD0BA0F81836379B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663957, "uuid": "4bb35f0d-9aac-4702-80ef-d9c0455dc5a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663957, "uuid": "567000bd-6d78-450e-9631-74d34f44fb66", "value": "12288:43zeS0aTLM8qcHa04yfyM2KuMGuvYKgr7O0YxxJ9VCZ6v:eqShTLM8qqa03bZkKgr7O0YDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623663957, "uuid": "b4a2ef1e-908e-4c12-b8d9-4bcad504b680", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623663957, "uuid": "f83e073d-a838-41a6-a050-9cb8d587a5ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663957, "uuid": "43086063-35e7-4d86-b218-1ffdf9b4e799", "value": "SecuriteInfo.com.Scr.Malcodegdn34.10468.11301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2963d1b2-cd0e-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623674627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674627, "uuid": "e93535a6-b518-49ab-acbc-13840df68ea5", "comment": "Malware payload (njrat)", "value": "cfc65a9cf2fb99f5961ea4c8b797d38b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674627, "uuid": "a9dfa1eb-93ed-4b02-8fb9-ec0274d529c7", "comment": "Malware payload (njrat)", "value": "4ce2b05633f8e0ffb7263a57069c62fd75b13dc48ff40daeae57a409a4d7f99b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674627, "uuid": "7314b740-b974-4449-9f7e-61e698f8ee6e", "comment": "Malware payload (njrat)", "value": "0c0a8449bef602385f93cb28cfd1d0b70c93787a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674627, "uuid": "3d38d000-1e65-4292-995b-1e32cff4a4d6", "comment": "Malware payload (njrat)", "value": "64598d3fa765ffdf14e634394f872fd0ab8e115c648ef63dc8f4b85eb680c4165f56d3e677b57f4cba39d68d5404afa3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674627, "uuid": "fa515138-1b91-407f-af9a-7e9baff02a5a", "value": "CA25399D3650B2DFC857C972CA981C64EBA0787B930BE743A05316ECAA4D997CF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674627, "uuid": "29e2cc92-84dc-476f-8899-e927ca35b0b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674627, "uuid": "04bc646b-4a7e-4de1-9256-4c70b58cc239", "value": "12288:ZCB50zWlMYEManwgYDFjTLMh1yLNnZEypI1M4ioIgYwZkCmz1zrgMg9VCZ6vhTC9:05llMYEManwgMjTLMh1q7EnR7Xmp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623674627, "uuid": "19ae9c76-eed1-43b1-9664-0f9847cf5747", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623674627, "uuid": "80df6a07-b4d9-4018-9954-03a7146aa76c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674627, "uuid": "cadcfcd5-eb9f-476e-b527-983a23d24569", "value": "cfc65a9cf2fb99f5961ea4c8b797d38b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2591f5f6-cd01-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623669037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669037, "uuid": "8a485511-f3be-4a69-8a8d-106aff87559b", "comment": "Malware payload (OskiStealer)", "value": "06a73490e2744b765871db1ebf92d843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669037, "uuid": "2f91892c-39dc-4cfc-91a7-6f27779d10e0", "comment": "Malware payload (OskiStealer)", "value": "4ef18eccdff8a6864d4396cff7d375158ac09fcb409d595a125b9756bee2c2e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669037, "uuid": "f517ddba-d596-4aff-8eb1-1536ddeda872", "comment": "Malware payload (OskiStealer)", "value": "fb55d7e7f5f2f3446855eab0fc8924ec227c1e17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669037, "uuid": "c9062166-acef-4909-b966-06515cbed50d", "comment": "Malware payload (OskiStealer)", "value": "7e880a1b4f48d7d53d988a63a12c752137eab6689db32af5b40e78be0b5ff79a68859f8db557210e16d2f87be2b3254c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669037, "uuid": "2b196fa1-41b9-4682-b136-015c28b4cf59", "value": "F4342330BAE1C05FF627527107EB5A5BF2BBA68F1994074BF7152F8E1A391C70A0714A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669037, "uuid": "d649391e-b3df-4dea-958f-896fc72dc8ba", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669037, "uuid": "acac382b-4c95-4781-ac28-be47f9d3f56b", "value": "6144:ksZRnuPMMy5UnJbDVAdtbN1NJBOmQDG9e:3qu5abpA7x1ROmQDG9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623669037, "uuid": "047c7be7-6aa1-4840-bdd0-681c9e36a94f", "value": 249149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623669037, "uuid": "69da1c55-bfe8-40d0-9ff3-d3071ba60a34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669037, "uuid": "f532e5b3-67e7-47a7-a0e7-650fe0bba4dc", "value": "RFQ-G-4786.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef7b7ba-cccd-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623646960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646960, "uuid": "af94066b-3ffe-4284-9dec-c2ed94830f39", "comment": "Malware payload (Formbook)", "value": "7504a2d91d88682cb8178fd3975b157a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646960, "uuid": "8f195910-9a9d-4509-a326-eb75d2ccd691", "comment": "Malware payload (Formbook)", "value": "4fda1896f5143497af8231a4a73f99381038088aad02e30141d5be3322bcabeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646960, "uuid": "55b6e210-1c95-490b-b3aa-b2db9a76202d", "comment": "Malware payload (Formbook)", "value": "65767e99dc714b53f623903b9974aacd75117833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646960, "uuid": "4c97c943-37fe-449f-b61c-f85f10b20ddb", "comment": "Malware payload (Formbook)", "value": "df5b0f6517674b3c85206072ac8ec3dcc0192cee92fa38da5804edf89682c2a21d54e29bf278991390a006f8c762f5bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646960, "uuid": "51e943ce-49ce-42b3-855f-2444a60fd778", "value": "1A34223777D99473D88A91B11FA28BAED3F6FB002755429B3B404E3E3D280D75E0A199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646960, "uuid": "ea2c035e-1fd1-4621-bb19-35be86820d0b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646960, "uuid": "9f3aa940-affa-4c62-8b38-43cd1afcf53b", "value": "6144:Ds9QFpUzv/wU5ltJ6kNFFGh0u9vi8FcjoXdZP:yQzUMU593Zu9viPjoXdZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623646960, "uuid": "8dce8236-909e-439a-83ab-93f1ca3c9e63", "value": 246179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623646960, "uuid": "e609ba4a-5663-4b31-9fe0-7ed6280c2f8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646960, "uuid": "1afda235-6a6f-4221-a0b8-6ec879770d70", "value": "Revised PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805b247d-ccc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623642131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642131, "uuid": "a27ccc40-5ccf-47f4-9a91-0042d9478343", "comment": "Malware payload (Formbook)", "value": "cd1a0f9ec30405d4c33566c34516a3d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642131, "uuid": "ff92326d-dda1-45e9-93d6-53155834d148", "comment": "Malware payload (Formbook)", "value": "51815bece05146989ce6d93b828d8eebe31ba56e340c0442a8151d9c0a5584fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642131, "uuid": "53828ff2-5a5b-4018-91ea-783df98c0527", "comment": "Malware payload (Formbook)", "value": "455ad63a9c402112f0461be5a383d61adc1b246e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642131, "uuid": "547bc771-1ef1-4e8c-bf36-eb2546512d94", "comment": "Malware payload (Formbook)", "value": "aa1c5956034303c51ebde8b7389a313072825d784d70c4ce22875ed3e131448c8f7c81589a81a8b6f1dd3d85798e18a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642131, "uuid": "5839b0d7-307a-48d3-bcd4-46ce021fcdc8", "value": "4045D112B215C95AD03E89344072D1FC06F1EF8E5A68F64B3DD0BA6F6D72385CA72B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642131, "uuid": "68185b95-ca50-4ccb-8332-aba8550ea650", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642131, "uuid": "093e1a80-8a22-4567-95d4-a6f22f4b116e", "value": "12288:M2EvCY6pLe/oMbsPRoErTaAYlCsWOyGqygX73uU5oah/2PD6JaMkPsmh9VCZ6vP:fEviJdMbIRgksWj3yAuQD0MkPLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623642131, "uuid": "5b494581-2737-46a8-8552-ab28155fadb5", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623642131, "uuid": "2ec903e4-a1d2-4e3e-b7fe-b80ac2ec61b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642131, "uuid": "9bc43dad-2a4b-429d-aa00-6e1e72469026", "value": "SecuriteInfo.com.Scr.Malcodegdn30.22750.2101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d728877-cca5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623629590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629590, "uuid": "6f0345e0-ddbc-4314-bcf7-3b9aa7e16214", "comment": "Malware payload", "value": "ac6ce34c9e9b7074dd75b8ec327ba43c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsevirine", "colour": "#956459", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629590, "uuid": "316c7fc5-cfd8-4cb5-8b5b-eb2eb1505454", "comment": "Malware payload", "value": "51b9296ff1f562350cd63abd22c6032ef26d5ae6a3e2e5e0f851d8b1a5d0ee35", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsevirine", "colour": "#956459", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629590, "uuid": "c50a01e8-d136-4b35-8f34-bcb9b72410ea", "comment": "Malware payload", "value": "e773e927f894226decb23258115e45b5861ad323", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsevirine", "colour": "#956459", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629590, "uuid": "87441fd7-81e9-4696-8d0d-49965ca6f132", "comment": "Malware payload", "value": "ad25dad29ed3b7fc217a23239b2d08d751ab927e03a3b979262ba10858169b6c06d9a560bdeeb3f5c35184687a5d0875", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsevirine", "colour": "#956459", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629590, "uuid": "5cbd582d-c0ed-4123-a4ee-4b642f72c769", "value": "42254B2F6F5B86E5C036917A85634606E3B1F4450B21FBD7C5D6722EBE37BE4083A620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629590, "uuid": "30b3dc3c-86f8-4d90-a9a4-4bb387efc64f", "value": "2d2aa79670bf41f8d9781b0220c1a399", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629590, "uuid": "16c0d749-50f6-48bb-a50d-fed0f755465c", "value": "24576:3sal3QIVzVznbFijIVnk3r8RlvsNCBGP0dSGdnWfVwu5m:3salBzRUjIV68XsQBGP0dSG0fV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629590, "uuid": "a9048acb-bca1-4092-a399-f0cf09f1fb51", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629590, "uuid": "dc353257-0c6c-4713-ae70-592fde1df58d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629590, "uuid": "662f0702-0045-478d-b6b3-64efcd7a767a", "value": "51b9296ff1f562350cd63abd22c6032ef26d5ae6a3e2e5e0f851d8b1a5d0ee35.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c526904-ccde-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623654043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654043, "uuid": "7104638f-e612-44df-b886-c734a08e750d", "comment": "Malware payload (Formbook)", "value": "ca778c4c61d1ae12fae467fd74c7a0e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654043, "uuid": "0dd34d2e-1183-49da-be58-61b57196976b", "comment": "Malware payload (Formbook)", "value": "51d73453a49eb5b24f57c74d0a383e878b8a0ad49b34cfe51cc3937762adc482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654043, "uuid": "da787e93-6df8-4a1e-8d73-a6d269b39073", "comment": "Malware payload (Formbook)", "value": "4563b738cf3382e55ab03d6ee0c7fffb8cdfecab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654043, "uuid": "f4d8f7e1-7be9-4c03-ba8d-9ac9085a4cb9", "comment": "Malware payload (Formbook)", "value": "d54c5f17a0f40f924a9a9b00030c8dfab5478177e13046a284d81cda918f1672b38402bd94efdad93e25d225d1758b5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654043, "uuid": "7a85402b-d3ce-4300-9d85-fa3aac16bbf8", "value": "22A402D971A8D13CE8DD08B84823914FCB6BAD2FC778E956225936896D786F00DF0367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654043, "uuid": "09769d87-1c6e-4f2a-9708-04096c80e92a", "value": "b840b1c1d0d81f6853fb6cabdba055e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654043, "uuid": "75e00456-3111-45fb-b3b1-922b992ff1ca", "value": "6144:PjWtJAc7tMo5IKME4+JURWWE1/FApHFUoPyFZnDM+V/CUi+4ko9ZqcwPqi6fKl49:P4fxJ5nbh1/q37PaZDNRCUC7mcwirC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654043, "uuid": "63a77c04-d326-4a0a-9c9b-976cd38c79ba", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654043, "uuid": "9d408c76-934a-4dde-9e57-e429d34692b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654043, "uuid": "9d124211-a35f-41ed-8a70-08e074d7fa3c", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919a1948-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629275, "uuid": "1dd61811-f000-48e5-832f-93fdcba4879b", "comment": "Malware payload (Gelsemium)", "value": "35e941f5df1560f0c2191c23e5189ada", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629275, "uuid": "d38b084d-0830-4cb9-a866-13a32ce93073", "comment": "Malware payload (Gelsemium)", "value": "5299fe79a66b407555cdab68806564ae988b745be589767b004f7bccd7f7ac3b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629275, "uuid": "40c207ac-f5fd-4cdf-a28c-b0edf5c92013", "comment": "Malware payload (Gelsemium)", "value": "a80c7010fea9915a0a82108139aec3aa2363f0df", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629275, "uuid": "ae5971db-e8b6-4d4b-9fa9-2947d41b5637", "comment": "Malware payload (Gelsemium)", "value": "e02fd076cf4c053fca2da2473147589bc4ecd81fc1694dafeab000b1b79c2349541e2356b3c4f998df8a455400c9b59d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629275, "uuid": "bb9728ea-8544-475a-a3b2-6804f1e6e4f8", "value": "FFC4120AFB671191F8328C3585F299BA4F396E732981A69FC798BCC948B250580D16FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629275, "uuid": "3dfda760-c5ab-4740-8dbb-cb7be20f9d73", "value": "8865f92665cdc6a1ce70409a70cfd83b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629275, "uuid": "277a776e-29e1-40c0-9485-198f0fa08ee0", "value": "12288:CyzXjTT0ZDrA8ZGZH1C3fasX9DJcRAM+J/Ahh/ySuQ0iqUFV85yFILNd:/zX3T0ZDrA84zC3fas7G7h/8QrqCUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629275, "uuid": "17611fd8-d62e-4e48-9971-c669ad9cff41", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629275, "uuid": "6d414148-10d8-413f-8555-8afdfdc00358", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629275, "uuid": "1d0f6180-2c6c-42d5-b831-57e0c3f9bfe3", "value": "5299fe79a66b407555cdab68806564ae988b745be589767b004f7bccd7f7ac3b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbe5a99-ccc4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623642850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642850, "uuid": "20dca472-c28b-49f7-b589-7f80af74eceb", "comment": "Malware payload", "value": "048ec3a35503f53f26bba3c4fb831e75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642850, "uuid": "cfd198a1-4804-45dd-b446-c154413b33fd", "comment": "Malware payload", "value": "535fdd4724b370968a01af628cd726a1f96bee606c30843ec48591b5fc0fa23f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642850, "uuid": "7b864eea-46a7-485c-a8a0-9a18a8d983ef", "comment": "Malware payload", "value": "eb4692556ed78e31b5746700c351e3b20873bfb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642850, "uuid": "f11185b0-5dd0-4096-a1cb-c7b806ef7edb", "comment": "Malware payload", "value": "998d4b072287a8369ea946eea7123a0b9fd6ddaae69251c0e4e823c1a04d7d77da3b881c22894063021d39e7658d12cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642850, "uuid": "a58c1771-2d79-45ed-b192-af4a58ae9c3a", "value": "042602207E82C132E5A281716D7DEB6A54BC7B750B7581DBA3C80E2E1D705C36B3A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642850, "uuid": "bcc7eff8-2d71-469f-8c0a-d5ba73e5b26b", "value": "d9c9b2207194e3b00f67e3fec7ad5f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642850, "uuid": "347344d7-ec0e-4983-8c88-104e0e21f8d1", "value": "98304:K1wpL+MIIwn5P3dipbX9DZhshMK0L7iOQzjumyCzEpqD:qw4Sc5P3KblZhY4ZQuZQzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623642850, "uuid": "a8f241a5-18b6-46ae-aa8e-7a0c20f4ac60", "value": 4676520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623642850, "uuid": "d8dccaea-4d71-4e18-9f96-022a42386ec9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642850, "uuid": "b151d900-372d-41c5-843f-32b2a6621edb", "value": "048ec3a35503f53f26bba3c4fb831e75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a61c09-cd1d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623681095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681095, "uuid": "e406531b-b5c0-4fe6-a472-9384b00736b3", "comment": "Malware payload (AgentTesla)", "value": "2897bebebd7ae828bfc0f1c0e45380b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681095, "uuid": "27287bc3-4868-4dc3-98a4-0ef9e2cc0b4e", "comment": "Malware payload (AgentTesla)", "value": "544d14c670146b4cd199c4608f51ff171fe373fe54fc72ffb55baa7e76d0ba38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681095, "uuid": "55f30cc8-0fd3-4b7f-a4e2-13c1582d47fa", "comment": "Malware payload (AgentTesla)", "value": "882b5cd3b6187d1065ec5f2a85e5907a18a4c302", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681095, "uuid": "214a997e-6afd-4f23-81d2-7240fbec60c7", "comment": "Malware payload (AgentTesla)", "value": "9dc88beaf8b363e546d993da245e13baa508de638a58ccb20d565cdc52ad309b560c41331997e3d6880c77ad122a7741", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681095, "uuid": "78e9be8d-3366-4546-85d2-c351259bf6d1", "value": "5835481E2E99E519E0E8C63D06F90027FF12CB73203AAFD698C3276D1695D41F96162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681095, "uuid": "4e5fc491-2ff6-4944-8238-bc32c321b142", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681095, "uuid": "0bce10f0-ac33-4c2c-9c24-2bfde5cf9ddc", "value": "24576:9mBVa1fBZnjG7pPCQ8khAqLysrFrJruCH9QXue:OYalPCNe7rFH9QXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623681095, "uuid": "cdaf814a-5bb2-43c1-ba75-d20e977dbbd2", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623681095, "uuid": "436ec58d-7346-46a9-87db-5a25ed44a301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681095, "uuid": "849df73e-fb16-4293-a7b7-6a281646eb2c", "value": "doc202124050032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a6bf3a-ccdc-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623653255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653255, "uuid": "88690075-0e79-40de-b79b-258731ffc85b", "comment": "Malware payload (AveMariaRAT)", "value": "b62f2ebe902cfe1cebb85b269f168637", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653255, "uuid": "257625cf-b37f-42d0-8b9b-7b68f46b428e", "comment": "Malware payload (AveMariaRAT)", "value": "5470a74090fda229660d99b498602172d806fee8a15ed77887788eb63f0ea785", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653255, "uuid": "5fb0709c-6979-4522-9412-967cb29f58e7", "comment": "Malware payload (AveMariaRAT)", "value": "a11ffcc5ce46c65b8c79a02d9bdcae67f7d250b5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653255, "uuid": "9ab59799-f09e-487c-acd6-b08103a99b33", "comment": "Malware payload (AveMariaRAT)", "value": "7938292916ce2c855143d2be340205b7233fbcd4e4cb8c531f43e4354bfd88b38f88a7e27bb3c097004a00f78c402bfe", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653255, "uuid": "e2a89e62-fdd0-488b-a0c4-5d4e0524a802", "value": "FC8508E0F9F0CD5ED44A8A33C1E80A79A52FD2580705A75A0665B62CFEE33ABCDC4745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653255, "uuid": "4d65bd5d-9fe8-453c-af92-d916b0e48a9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653255, "uuid": "7934a9a9-caba-4228-8ab9-138b3dffc802", "value": "24576:rEPkGRPl63+trpFgAtFt0ZCHuwNbZEj5bgxNK:rAe31Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653255, "uuid": "2d71565d-5a7d-41c7-8510-acc8f71c6d14", "value": 1790464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653255, "uuid": "f53c8a03-16ad-48d1-ac7f-57d9881902a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653255, "uuid": "e113970f-93b8-42b7-91fc-f8a5203cb671", "value": "Copia de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b360d9-cd01-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623668987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668987, "uuid": "b770d351-ca1e-4224-92ae-81024a019b4b", "comment": "Malware payload (AgentTesla)", "value": "46e530bd1d4af9fb8a4524642243161b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668987, "uuid": "fe25e0e5-2112-49b8-a94a-5502bb6214d8", "comment": "Malware payload (AgentTesla)", "value": "54b0ff9d62ef4867ba3aea9daa53c21a2b9e7ed772504e960bfc1d568ecb3850", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668987, "uuid": "fb71862e-2244-493d-a002-7f52e2896ab0", "comment": "Malware payload (AgentTesla)", "value": "6c0b5e411be5c9063ed0132bb66924ae257fe1ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668987, "uuid": "9abea768-c03b-4027-b4e5-c10b6a8b77fd", "comment": "Malware payload (AgentTesla)", "value": "63d9eadede832ed3c06949e558be41652dd61c4ab671e1d0372676b3f4cde504ec0bda2c6ce6ef3c649f045e9699d061", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668987, "uuid": "da8ddf34-9597-4dfe-8b53-2cf9188e8659", "value": "247443A4109B8271E6444E4D75C0B2C95E74FE9230CACC29A3AECA75CF65AF62FC45D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668987, "uuid": "9a42d272-079a-442b-81c7-e5a698313dba", "value": "1536:9gBrB2BrBELW3/WMUprQHuEZdsHWS2w+V10p+abQyydzFzl6mAg5eeVhMDw5wfLj:9gBrB2BrBELDbKdzFDr5RDAw5wf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623668987, "uuid": "ffd6a29b-0a63-4354-9c2d-b0199c2ce8d2", "value": 355214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623668987, "uuid": "ff0d5bab-63ea-4bf5-9d62-cef6626693d4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668987, "uuid": "329b0aa8-1781-47d9-ae81-26918bde34fb", "value": "ORDER SPECIFICATION.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78744af1-cd23-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623683779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683779, "uuid": "0d935f12-3978-4968-8764-b7ab8af5a841", "comment": "Malware payload", "value": "90f830f394798beeab08062829ad1103", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683779, "uuid": "51aa5d0a-3573-4e2a-adcc-c17196fdc8bf", "comment": "Malware payload", "value": "54f88a13720f577d84c6e97491f588e7c79b4b6e9df490faef663de2c19cc12c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683779, "uuid": "64791e8d-2c9a-4a8e-a2ec-cd301ad4f463", "comment": "Malware payload", "value": "14ae965eadf99d78177ca24544de9f7b1d35a744", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683779, "uuid": "0b0262f9-9870-439d-a57e-02ef1203bba7", "comment": "Malware payload", "value": "2ef64c33b3deb9490c3cd527e329cce5e55d65db9017b7a46ed712187a54ed2a8676c7e9b18bee5d9b910fbd9d358c74", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683779, "uuid": "448738ec-9cd7-44f0-b695-f343766b0774", "value": "B133D110D032D914DD6E983EA4FA49A1F63706D473D88267ED58814E0E66CBEC46FECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683779, "uuid": "82c0f247-4ea6-406a-bec0-194d49746ff8", "value": "768:/ZwVvSzwK91d9Q0vbQRbsvyiR6EXqEtG1sxFws9Rd4vDU02H2GPGeeqQSGuo:/ZEU1d9Q2EEXqEtGFkRdcD3VWFQSHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623683779, "uuid": "cd2e58d7-d896-49b0-b642-6a375a924ff1", "value": 50443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623683779, "uuid": "4192d18e-27a1-423c-a647-d658373afb7a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683779, "uuid": "8f30abe5-f663-488f-841e-c04ac7466c5b", "value": "material_06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41f2652-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629360, "uuid": "07303480-71cc-4e45-9249-076a0b6852c9", "comment": "Malware payload (Gelsemium)", "value": "97d46525797ffa7530851481eb96dd47", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629360, "uuid": "19adad64-399d-4058-864c-a7ad0431e1dd", "comment": "Malware payload (Gelsemium)", "value": "552388d74478a84b8e64e3ee2316331740a0d060f322e92b5c608ea745adba90", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629360, "uuid": "f908f101-bc0c-4e19-aa48-c9f3ab93ce29", "comment": "Malware payload (Gelsemium)", "value": "0cedfb1789ef139b6040cf8d84ba130360c4eb7d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629360, "uuid": "c694054a-96f8-4a8f-ab34-42cb1b42eba9", "comment": "Malware payload (Gelsemium)", "value": "876642324cf0f404fa90eb8d515ec03ac93845d7445a76f37891ada9f419a3e0589637ee264684ff409c118ee124afca", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629360, "uuid": "db791e40-9874-4a17-817f-da8a4d29146c", "value": "1D65E162B913C073E462047696BD8F730C2E6D35036990CBB3D47D6A5E707D2363AA9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629360, "uuid": "3d99aae3-bcc9-4e71-862f-3f5915219778", "value": "bc2fc243ef7d8195d819a46d79fd67b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629360, "uuid": "732a0890-32e8-4652-937f-237f371b0e6c", "value": "24576:yUg0jjR2N7A9ny+kZ5DUgKi45mTduS9Nf2lVhTnjo2pEq1GzKoBky9SvJ0+:yCd2/+QIxRUf2lHT4c5ogO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629360, "uuid": "c93579d7-cb99-4c67-b3d5-39f4c96708e5", "value": 1464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629360, "uuid": "a1459e39-f5d3-4ecf-bf97-046b672d3879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629360, "uuid": "749118f7-22cf-4875-8b56-311f0b119215", "value": "552388d74478a84b8e64e3ee2316331740a0d060f322e92b5c608ea745adba90.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d1356f-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623654674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654674, "uuid": "f31ce319-52b7-4f0b-af7c-ab104f7c2a7f", "comment": "Malware payload (SnakeKeylogger)", "value": "3b6a3dc3e3e91896218aef6a0627138b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654674, "uuid": "1899db2d-ad90-4442-8100-056f5f38e11c", "comment": "Malware payload (SnakeKeylogger)", "value": "557c50f4f6b6531ee6b6b82e0ab46ef9a8d925ce60d593d017832ae333816382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654674, "uuid": "174a5c76-fbe8-48c5-bbfa-6f9d1ec89d64", "comment": "Malware payload (SnakeKeylogger)", "value": "ea531dc9dfcd99a81b3da5fb64ef7001be72f014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654674, "uuid": "1793d114-381b-47a8-b039-bff8c99ab3e8", "comment": "Malware payload (SnakeKeylogger)", "value": "b24a568a6394df27b90c147467db0796cac5ac3e9af613833297003a2033f7ef0df786e2ac5446d3b7abdd1e757b675e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654674, "uuid": "dea62061-2185-4086-965e-45862df6d416", "value": "9C155BF4F198A8A2C59EC731C690C8BADBA15AFE5243891C0DF5CECE3B4374A8F59445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654674, "uuid": "18308ccc-1218-4455-90ac-ebe8619facb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654674, "uuid": "9ebb8a70-7b17-4d3e-b41d-fa08d8bb0335", "value": "12288:2CBYEaHZ6YhwTuCUa3oTvTYmObkxHIcwIavrxNO4e5JxYmRdbtsyGcn:VYEa55hwTu3a37mrTqxNO4eXsyGcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654674, "uuid": "8175f1ff-8e23-458c-b4a5-272f1878f2a8", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654674, "uuid": "51cc6a92-94b3-4432-b17d-477410d83326", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654674, "uuid": "fe7bf593-beac-432d-bdaf-0ddb66dfa5a7", "value": "NEwklBxmIidMJDI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b46a09-ccfc-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623667029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667029, "uuid": "496d2cf2-5089-462c-9524-6d45c3a13562", "comment": "Malware payload (AZORult)", "value": "40e4a6b483fcba9ff6e500cc6c20924a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r27", "colour": "#23853B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667029, "uuid": "993c1e9e-9939-4829-93f3-bee22db5883a", "comment": "Malware payload (AZORult)", "value": "57415ce89fed352f579259b19da939df9635f8e2272838bebbfb4d48e59c68e1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r27", "colour": "#23853B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667029, "uuid": "d7f40b36-6ed6-4c8a-9132-9dbcca592d83", "comment": "Malware payload (AZORult)", "value": "915fa3ae67271a80bfd7023522f8a0535a8534b9", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r27", "colour": "#23853B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667029, "uuid": "1dbf96bd-ad41-41a5-8ce5-bd481fa9e51e", "comment": "Malware payload (AZORult)", "value": "ec2f20d8f2721098504fdf006bcf8de7083732d8f2d17ed28078b0d32fabb256977b6af5cf542d6f923ff38d97e5c78e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r27", "colour": "#23853B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667029, "uuid": "07e2798c-f55c-40fd-8b47-d899bae561bf", "value": "BED312F630212864BF3C29F50C536E9F32AF16968E6EA56D1A6BE047B2744875494CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667029, "uuid": "0e3203d7-8a8c-4cdc-b8ce-1418e6597d2d", "value": "3072:2TunUKit29MIN0r1acSF4f5I4nq+1fqPjfOApWza/wY:dnAfIN0J0F4xFbcOwW+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667029, "uuid": "4cc637eb-0fb2-46e0-865a-bf17b222f750", "value": 138308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667029, "uuid": "a249521f-cd5f-40d2-b6e5-76049ee122b3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667029, "uuid": "a865089c-0555-42d2-8fff-891cb0591e6b", "value": "4 Pallet Shipping Docs.Commercial Invoice. Packing List. Bill of LandingTHS0094587.r27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870ab900-ccdb-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1623652880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652880, "uuid": "d9c5d8ce-e552-401f-acce-09f1e6409985", "comment": "Malware payload (Adwind)", "value": "db86d5cc0509a5ef527577bd65d8d4a0", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652880, "uuid": "220a2c11-4f22-4f70-8e64-204e354ebac5", "comment": "Malware payload (Adwind)", "value": "588fbe37d57d2ae7d360403a2613e273b4f0339762c0bde74f246a6c4541ce5d", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652880, "uuid": "892241a8-c0e0-4693-bc30-dcd03a57ee40", "comment": "Malware payload (Adwind)", "value": "f03f1da605d06707130cd49d2391295e1ffbf5ee", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652880, "uuid": "882c10bb-b12e-415d-9bec-b0a20165c6eb", "comment": "Malware payload (Adwind)", "value": "c67d9e78880d9e758c134afcad178ce8a148f0573b17203343afd90a7d2b6f75c57facecb2ff871d43f0de7579706ccd", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652880, "uuid": "1e52e9e2-966a-4fad-95cb-d65d5d0b7d86", "value": "367412C532D0DA36E09640356AB3E5583349FC466F01862EF6A87B1EFDF1B65C984BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652880, "uuid": "72baef47-fb72-4d36-97a3-32cb5d768816", "value": "6144:ocFA1aPW/KNnmtilJrGWwSQot6A7sTEwLGcFFqe0NXMuvGdShH+okAW1:rm1fKNnjPiEQI6bEwLGAF/WXMCT+TAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652880, "uuid": "0dcd4081-6d76-4762-83e4-e85b95a4473b", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652880, "uuid": "3ad85478-0870-4244-86f2-0e9fbe777e81", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652880, "uuid": "fa9ebac7-3f4d-43cb-a818-c23f70e71ff2", "value": "07.06.2021_SIPARIS_LISTESI.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b729b93-cd09-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623672617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672617, "uuid": "377e9642-4b43-4c0f-8489-ccb958722ec3", "comment": "Malware payload (AgentTesla)", "value": "15b04764294d7601159c97aab77360e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672617, "uuid": "b810beb6-5137-4404-9214-ff148d01cd52", "comment": "Malware payload (AgentTesla)", "value": "58d63d03e318d5648ac95d2cf861a29c6590551d088d6ba9efab3167303d5900", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672617, "uuid": "cd4aef3f-6a65-4832-9ded-a60dfb932bf2", "comment": "Malware payload (AgentTesla)", "value": "5f07c1fa56a4cbb98e3dad472adda79de5575973", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672617, "uuid": "4114bcc4-5e4f-4bec-98d8-775910336fd2", "comment": "Malware payload (AgentTesla)", "value": "bb431da48a7342fd87bdff56fff0f44897afb2152f390517161c52f52574b7135cd89a786bb029c4ba1b7ac21c042a96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672617, "uuid": "db0e174d-b24c-4f74-a832-77373a55df21", "value": "439401143AF9903EE1775F771AE467D19A7AF9A32806FA4B3488134F5603F81CC9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672617, "uuid": "b343b270-2c03-412c-9a70-85573590841e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672617, "uuid": "d101212e-5cea-4831-ae9c-2d333b3c3881", "value": "12288:iNpU7k3eWos6pRk6R8xeRvDSTRaz94It1:KUg3gs6jk6CxeRvDcR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623672617, "uuid": "9b1932b6-20b7-4a6d-bc70-27b0cd53aa2b", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623672617, "uuid": "0d5c4f47-4124-4e8e-b97a-99e484336a0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672617, "uuid": "eb582f4f-a972-46de-a386-ee45e7b1efc5", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e48021-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623653740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653740, "uuid": "361c5e37-a9ad-4139-a14f-62abb13623e2", "comment": "Malware payload", "value": "bfc8cc30d52a348b6e764cf9f0e60121", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653740, "uuid": "f8156ea4-9450-49af-95b4-ce7247d3dd69", "comment": "Malware payload", "value": "58e9764c5b1448602c97ef5483bf93bec347ebfc6b258cdd8258875351587879", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653740, "uuid": "4650a360-cb12-4665-bf95-864fc8e0079c", "comment": "Malware payload", "value": "ef42fbfb721bc01767dc467dbe35fd50843a5706", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653740, "uuid": "64fc0de9-7248-4f27-af8a-f80d938aaefa", "comment": "Malware payload", "value": "c77fcc5145dadafc48c461d210782a80f5e20ea235a672596acf5632239c3dd1fbd9a021fe458b4877648ba9926bb904", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653740, "uuid": "3284f4ae-bdac-4fd9-87ee-4faed2243e16", "value": "E051AC101EE21798D27257365BEDF2A26673F866F83EDF7941409184862B480DC61F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653740, "uuid": "217e01a6-e2e2-4a12-b538-b36c25dbd35a", "value": "48:8W6lBHp/YKW8QRr5sa/eW6ao/JEgomaR20w:8tBFU56Big57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653740, "uuid": "4654a77a-8d73-4c91-a8e8-bb10e0da6684", "value": 2525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653740, "uuid": "0459ba54-2d5c-40cf-91e7-14f650e6e0ac", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653740, "uuid": "ec9aafe1-8a29-491b-8e8b-6a9b975aedc3", "value": "Image003.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b53925-ccea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623659404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659404, "uuid": "dc17795e-a221-4a8d-ad03-ccf001607a90", "comment": "Malware payload (AgentTesla)", "value": "17fa160ecc8c4cc762ff8fe5f7aa8a70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659404, "uuid": "172f4e63-417e-483b-8184-ae30bed3902a", "comment": "Malware payload (AgentTesla)", "value": "5a72b38c3ea9ca9b5a3e10a3c1c14e6ab3e26d6a1cc4afdf5e9c818175bb9ea5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659404, "uuid": "14bd1806-c4f7-4548-be1b-4c47b61551b7", "comment": "Malware payload (AgentTesla)", "value": "8b5ebe10f55331cd0c78557c6ddba35589366a0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659404, "uuid": "bc083783-53bd-4a76-b052-3c306a386991", "comment": "Malware payload (AgentTesla)", "value": "70dd17be52ad87e491e2edfd32e8e7c13d96ef2e66b11f1691d76ba4db4cbfd20df1b5d489c21f6d53e97f582d308cc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659404, "uuid": "9d7ba9e5-00ba-4ac2-a398-7b0431ca6240", "value": "D405E02232C82BA4D5BE6B794632510093F7BA17D736E64D7FAD209D1B33F418A72B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659404, "uuid": "2689f3a4-8fb2-4abe-b382-18dbb7229b01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659404, "uuid": "964c14f0-20c4-42d8-81db-1c27f97da424", "value": "24576:McVB/3TLbO6K3vBvU8+ovY2cHzNNeBUdt:hBfX5KJiogLTNwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623659404, "uuid": "04805fab-3375-4642-8844-e66240599a34", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623659404, "uuid": "d5702117-1bd3-4493-9804-0616ba1aa69f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659404, "uuid": "4c23edfc-b0f1-4252-a95f-fd2c897a4943", "value": "17fa160ecc8c4cc762ff8fe5f7aa8a70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e3288c-cccd-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623646977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646977, "uuid": "a9df4f03-55ba-4e0d-80b1-e534ae3fae5a", "comment": "Malware payload (SnakeKeylogger)", "value": "72323e57bf89e4ff5558c17139ca0e23", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646977, "uuid": "1a377488-a312-46b6-ab84-ad0e889a4ea0", "comment": "Malware payload (SnakeKeylogger)", "value": "5ada22900521d5d10af5b785121c9fce55027117a681246d9781f0eb087a9f3c", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646977, "uuid": "116461fd-db37-4827-88f2-e7cdc0a25982", "comment": "Malware payload (SnakeKeylogger)", "value": "2c36e3a2f55106fa36004d79a1f2424ab1917bff", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646977, "uuid": "23f1bd25-4fe2-4220-82ea-c19e26f217ac", "comment": "Malware payload (SnakeKeylogger)", "value": "0ec924980105ac60c0c5b994c366d5361b9e073c11b40bb6ec6798fd40ede745c455bb5cf6ef93af02d085c8bc9c048b", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646977, "uuid": "d8269f44-6f11-466a-b6fe-858519b75b26", "value": "80E4237D173B07CA6AEB701900D2D037B25AE7305BF0A0907C06EF57891BD9CAA7A574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646977, "uuid": "95af7a84-a1c7-4885-8b19-29e0ccafdfdf", "value": "12288:/A1qiQSidk5bTTd79YXQWqoFflQWx5ypwD5U1/0pwmDwJhza5HXqgeKqkW:/MqiVJF93WFfSWx4pA5U2bga5HXqLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623646977, "uuid": "914d8a22-caed-4147-889b-f64a8a85f83e", "value": 669531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623646977, "uuid": "3f01baed-651f-4e06-8812-89cc3490037d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646977, "uuid": "18c173d4-c07c-424d-975f-3fcb27677db6", "value": "Bank Swift.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe0ba79-cca7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623630634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623630634, "uuid": "ad25b3b2-b5aa-4a4c-aaf2-9bd75361208a", "comment": "Malware payload (RedLineStealer)", "value": "a153fbdc2659186ce4147a2149a0cd85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623630634, "uuid": "52429e4b-03f4-4d2e-9913-272d53fa4696", "comment": "Malware payload (RedLineStealer)", "value": "5be6e545412f81d95e255012405473ab48b5d4251131e4fb0b2156f8e3798266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623630634, "uuid": "9fd09608-302e-45fb-8720-18529110fe53", "comment": "Malware payload (RedLineStealer)", "value": "1abda866c20e29255363b2ad1291938754cc3911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623630634, "uuid": "b10589ba-3019-47d9-90f3-375ab1716187", "comment": "Malware payload (RedLineStealer)", "value": "d881f8e3f59269ffb53d3f3c73d2c7c1023e9cf98582e3d5fd13c23d87e57da7a57d7afa80371df790df9a1543450a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623630634, "uuid": "2041d98c-dd63-4a24-9385-482e746762c7", "value": "A084F12C2FFC0916D5BBAFFD54E42612C77AB1333A53E749095121A60A23FC5C9816BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623630634, "uuid": "2beafe87-c472-4584-83df-89ef06351dbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623630634, "uuid": "110f9989-9cec-41a1-ad01-94645d1a2508", "value": "6144:Eq0f9MZp3/6tyske1mpzFCquONxKD1PdSYGUfWEedFbbEL9lKFA0ekqYNLb:Equ9+p3/6B8HuO/o1rGnFfIOW0NqYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623630634, "uuid": "48441737-c63f-4426-bc65-2521ae5bb304", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623630634, "uuid": "9c744f8e-7418-4168-be75-7348b878ca2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623630634, "uuid": "f0d01415-6def-42fa-8d05-27f13ba8a8ac", "value": "a153fbdc2659186ce4147a2149a0cd85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e717c1-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658973, "uuid": "b6da6664-858e-4320-a87f-0a7d2d3e7c1f", "comment": "Malware payload", "value": "42b6f7b87ac723ae966045d15aa870cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658973, "uuid": "f897cf84-e5f5-4c69-a396-03a7ed680490", "comment": "Malware payload", "value": "5c22349999da72022b2debf0ec0138711572cfefd6b26a5925700234030d68b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658973, "uuid": "34f36e67-9dc0-427d-9173-30a3e5e376d8", "comment": "Malware payload", "value": "eeada900b448117f916bb4a01b4578cedf44f686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658973, "uuid": "3fda3711-8fe6-4aed-9449-d85fde69256c", "comment": "Malware payload", "value": "4985ecfce927b1ef75b43b92063d88f68b3e90caf1f00f8172c82013c6dc55fa55c578fb030b77d0b29594ebe0a566f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658973, "uuid": "0a7341a7-3883-49e4-aa48-f37619c4b013", "value": "5E84BF109642D039E9A261F98AFE9339E11D6BB2134C70CB53E66FF5D3A91E06C3185F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658973, "uuid": "9dfe4d6e-8738-490b-96c5-cdcb5a5947f7", "value": "6144:eRYSiJPYpz8rAj4G9Qk138WEiI9m1bXmEK43R0gM3bFvGNBjCYr3rCV:eGSePYGc0G9Qk1PEiw+1RXMLVGNBuYrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658973, "uuid": "c7f6c364-7597-4bd6-af57-f997a832a948", "value": 371398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658973, "uuid": "bdab6efe-a72d-48b1-bf8d-6ef4f9208853", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658973, "uuid": "bb8b1e53-a7e6-4d03-abbe-265926aa74f5", "value": "42b6f7b87ac723ae966045d15aa870cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df2ae18-ccde-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623654206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654206, "uuid": "adeb2b6b-d0fb-45e4-b435-0c2aee27f7e3", "comment": "Malware payload (AgentTesla)", "value": "a40bcf633bcd36d75c5d0678220651aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654206, "uuid": "a6e41640-fc49-4a79-b021-6b355bffbe2d", "comment": "Malware payload (AgentTesla)", "value": "5ce6dec8c6a10994837f107f1574f2280787434164ae65406700d5c543bae130", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654206, "uuid": "75a61eb9-4d88-4536-981b-80da6fa09441", "comment": "Malware payload (AgentTesla)", "value": "e853f5d9039b546cec79613c0790c6a257367a3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654206, "uuid": "fbd53937-8efa-4fa7-902d-458d22e8689d", "comment": "Malware payload (AgentTesla)", "value": "98839d2a3eb182288a4d929d53b8f896f714cbb91ee9038b387b4162bd483a34b1c06ecac26c2be17ecc908dfb689938", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654206, "uuid": "ddb53fe7-9a37-47f8-8ed5-d61f04b02a75", "value": "77A402103FED5029E432AFBFD9F57741DAADE1767602E64B6880075E1A13F84CE81A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654206, "uuid": "fedcda8c-2299-4ea6-b36b-514003b44cb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654206, "uuid": "94ac36a0-2794-4ea6-bbff-d6954346350d", "value": "12288:aG2A6IGKseP6gIyoH8hO1h6drxXkQVW/oqpIt97:f2A6XKTGpH8hFHUoq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654206, "uuid": "658e2819-901c-48d6-ba3f-3804984d031f", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654206, "uuid": "7ae604cf-0474-4ea3-8c17-208cc8e6f1c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654206, "uuid": "612f15c8-f62f-42cb-bf05-9413769f04f9", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501141ef-cce7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623657941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657941, "uuid": "3ef4116b-e155-4be8-9dd6-c9703e22a59c", "comment": "Malware payload (AgentTesla)", "value": "d5dd676762317bfaacccfeb8d82f8367", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657941, "uuid": "ff7245d3-c42f-424c-9ca3-4df238afeb28", "comment": "Malware payload (AgentTesla)", "value": "5d6ebddc0f862adf831954ac82f4f36884261cdea3f172027cad50e704079748", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657941, "uuid": "9682604d-f248-42ef-a465-e6d956ecf4bd", "comment": "Malware payload (AgentTesla)", "value": "f6d80afeb028f04b542db9a3032be829e47fbd05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657941, "uuid": "07d00264-a73f-41a9-87a0-ab3f02a9002d", "comment": "Malware payload (AgentTesla)", "value": "a33744c2a9ef47857e6c4568fa52ff8c9b16edfd0c219e0b8b176234bdfe5961f90cac8de3d6556287212cc7466d8749", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657941, "uuid": "f03b4d32-10e6-4453-855c-e01f666601aa", "value": "33912C55F66C6657FC2601D68431FD8C1EF2B45986C73585B46CEC9403E3B73ED52881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657941, "uuid": "8a4daaf9-b501-4e2d-b85e-867f96eac414", "value": "96:PmjftYxZOTmijTOlZ/44M+6mBaLHbfLcn25cxC:PefixMTmijTqxSjcnQcxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623657941, "uuid": "1afb5a88-3a5a-482d-9046-6768f8786d9a", "value": 4226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623657941, "uuid": "5934cc99-17e9-48f8-821c-51ceefd3fb15", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657941, "uuid": "043a9c64-08ad-4d0b-8abd-c3beab42929f", "value": "NEW ORDER LIST.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9106a256-ccd8-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623651608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651608, "uuid": "77fec8b9-f274-449b-a558-452de4c64e33", "comment": "Malware payload (Gafgyt)", "value": "908c5938184b86885a2df49b92feb625", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651608, "uuid": "44f9219e-d939-4900-9d44-3ea559510bff", "comment": "Malware payload (Gafgyt)", "value": "5de5b346d86298f7141f8f7f002a9b79d515a01d4aed8e8ffc0b04013836cf9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651608, "uuid": "47c7d26d-a0e2-411f-9150-ee5863bb22f6", "comment": "Malware payload (Gafgyt)", "value": "a0138f0e0bff7eeded16aac0d2e9e3fdd32c3145", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651608, "uuid": "cfeb0151-a2c7-4938-97e0-43bd2171ed73", "comment": "Malware payload (Gafgyt)", "value": "13132d4a942b84b8501ad1943f62fd8eb8a12ecffcc3e56383550fdea61c1ab98c806e95fee5e506f7e6484206d6f41a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651608, "uuid": "085bb5cc-0b91-4578-b032-f436638540ff", "value": "29E3756E3E21AFBEE268867107F75F70C39525D326A19382E26CD6085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651608, "uuid": "d983f618-04ca-4716-97e7-ae2a630d1522", "value": "3072:MzBM1x2GPyaT/A5hKGE6aWURxuZq+1uPNd5R:ENORA5hKGLURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651608, "uuid": "3c2d38ee-5c8d-4222-a858-2b6904e3cd7e", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651608, "uuid": "fc81e0e6-fe78-48cd-be71-0c5e93b181da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651608, "uuid": "68a6805a-e76f-496d-9e7e-b3a4ae9ac269", "value": "908c5938184b86885a2df49b92feb625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452bc1d7-cd30-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623689276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689276, "uuid": "853ce527-17d6-49f7-8b7b-5bc7c45bd3b5", "comment": "Malware payload", "value": "5f32ab11399c7596889739620f178464", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689276, "uuid": "10ccebd3-ab5f-4198-8550-d071e685ee26", "comment": "Malware payload", "value": "5e8f1d5b44cff748ac52b4e8b945dd34e8d2b5ae6659076af594ff9bfde45109", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689276, "uuid": "29f4a6c9-b07e-4ed0-809b-f9960076811c", "comment": "Malware payload", "value": "555799fcc457dc022711785cf32660fb4b0ad233", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689276, "uuid": "750b21cf-5889-4896-979a-8544cd351053", "comment": "Malware payload", "value": "485064fd4e633cf2018888bc0c4ef49300bd8fddb6555a7d7b6e6952eee8c49e018b280dddb4e2be8b5ebf8b33fc81c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689276, "uuid": "f26942e8-da25-4871-9357-9e0902f9a2cc", "value": "BF2602207E82C132E5A281716D7DEB6A54BC7B750B7581DBA3C80E2E1D705C36B3A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689276, "uuid": "ab8b3515-0d06-4960-855e-6109b7e55895", "value": "d9c9b2207194e3b00f67e3fec7ad5f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689276, "uuid": "f51924ac-4d1e-4f94-a534-277823a37b1f", "value": "98304:H1wpL+TIIen5P3dipbX9DZhshMK0L7gVQzjumyCzEpqu:Vw49u5P3KblZhY4wQuZQzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623689276, "uuid": "a31cafb5-5163-493a-9127-3aaf7e704f80", "value": 4677032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623689276, "uuid": "f4cd4748-8525-435c-8647-e2bba963a940", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689276, "uuid": "7118c2ec-f279-4755-8698-354c40ee0185", "value": "5f32ab11399c7596889739620f178464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07777801-cd0b-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623673281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673281, "uuid": "f1b06360-4a93-4f5f-bd64-e38d5f9dcc1d", "comment": "Malware payload (OskiStealer)", "value": "f1fa400677ae1912054f91992aabc1d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673281, "uuid": "a74390db-7794-4a0f-922d-76cbe486a4f6", "comment": "Malware payload (OskiStealer)", "value": "5ef587508f36d6575eb198d08c8290fd4d91288bbbffedc57430a7275037bb48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673281, "uuid": "0aedbb55-1c92-456a-a70e-2794c1c98af0", "comment": "Malware payload (OskiStealer)", "value": "78e44b5e7963c23780e9ed89190bca669e2c414c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623673281, "uuid": "99d0df07-984c-4ec4-94c5-2c0e6922007c", "comment": "Malware payload (OskiStealer)", "value": "1601833b735ca03cce03d9d4927a2c58bcfb9a6350e2ff26f8c1121bb451c1ef8722ba1659335b238ec9a2e94d73e77f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673281, "uuid": "57b776bb-a62b-4b16-a522-2d1d8a9cccea", "value": "57A44B55725B32E3C9E0A53893DDA1A3B7041C210F7EAA1B5ED9BD7E837498C9A2013D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673281, "uuid": "20ec0188-9985-428f-9df3-5afb1568dc05", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673281, "uuid": "8727b1a0-fb2b-40d9-aeb5-749e08d23b8b", "value": "6144:OsSdCmn/Gre/TuSuAL+xr3ZJJvb7156/bggUCe0MaQZDfGWcZH+znwe3915:odCmn/B/TuDT9pJJvb7150cTz0WXHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623673281, "uuid": "44a5b703-5c4f-45f7-9ff2-7263d00353c2", "value": 454961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623673281, "uuid": "5ce64536-5728-44fd-af06-300a6eff33ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623673281, "uuid": "d0dacb07-b8d0-40a3-9793-dd854d4dba16", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd696ac-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623653668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653668, "uuid": "f78732d9-71ea-4dbc-8ca5-21e247f2a635", "comment": "Malware payload (AgentTesla)", "value": "3bd6f80185d371861b108a24b3c07d67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653668, "uuid": "f8f96d74-ae54-4ce6-844a-ad9e926eb4a9", "comment": "Malware payload (AgentTesla)", "value": "5f0d4340a36ee2655f528e603547a0e9216d5a019f414ea84c9e9ec59110ffce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653668, "uuid": "17fbd72d-f588-4be5-b1b5-0f6845786d5f", "comment": "Malware payload (AgentTesla)", "value": "3158a36d7834a8052a38c83837df7f5f6a79d952", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653668, "uuid": "a4463cda-e49a-4bfb-a61f-ad388dc865f2", "comment": "Malware payload (AgentTesla)", "value": "4bc0af84c6daea05e3466374b1107906d28a640cc25037a8e3d42d0cc7357f35bc7482f263f51571a5e5498b38d0d5c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653668, "uuid": "5d8cff0f-de2d-4f46-ae46-b8d679bf3e0a", "value": "3B4412097DC045EEF44B143607B2B7EAF7B677623270521B2F504F2D2B5B286DB99282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653668, "uuid": "92a13486-8b85-49bf-9154-a7961c8c6bd0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653668, "uuid": "afab7277-442a-4312-98fa-36a543a8aec2", "value": "6144:8Qq+AXU3NqFXFFcPqgBqNwxXyZdLnXQ8hp:TrYBFFcPCNw4ZdbXDhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653668, "uuid": "6b4313ca-5182-434a-b8f5-fcaa7fc49656", "value": 271767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653668, "uuid": "f35a7d71-76f5-48db-97f9-0350a3bb8401", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653668, "uuid": "e0ed796f-df85-4e6f-83e3-34e47036f0e7", "value": "Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413e4d96-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658775, "uuid": "fbb64efc-3ce6-47e6-ba38-b15c88e7a1b6", "comment": "Malware payload", "value": "cb7ffb456b7c7bb1d0f68d44bab71eb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658775, "uuid": "07226cff-0791-4f0c-a971-c122d776effb", "comment": "Malware payload", "value": "5f90abf9c9f9a4f6d1023d208bee7a429a738c290b2e67b59b47481e06a3b840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658775, "uuid": "f2b85ea8-050e-4a9b-987f-4a09483b505b", "comment": "Malware payload", "value": "72238bfd5f8ad8e4afe1924851c236a52ac9be88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658775, "uuid": "a90f43b7-24a0-450e-a345-cdec82f591d3", "comment": "Malware payload", "value": "83b25f6ec83374eb741bec2e72d28661c16fa53a7c04a4bce52208100d2792b634f21e6789388e7f80bed99435ce47d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658775, "uuid": "f446f425-1f0d-4f64-967f-e4d2960a7568", "value": "F5050100A790C0F5F1B653F869B6DE79A5BA3AB05B6490CF62C61BDE5634AD0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658775, "uuid": "009875fb-97c8-4cda-ad09-e88a3a456bb8", "value": "76567453f097005b8c49393a915ef4ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658775, "uuid": "db35b8d4-0f66-44f0-9ffa-4d0acb3a5a80", "value": "24576:epijLdo0+YA6U0UBFTZqFneMhqH3Lcyu:eX0+YA62gFDh4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658775, "uuid": "e48a48b6-ab95-4329-b4d3-7eeb983735e5", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658775, "uuid": "0e962570-9e84-47b7-b73b-241c79f8fad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658775, "uuid": "ca6ab760-ae5b-48d5-a81f-c1a23f80b3fa", "value": "cb7ffb456b7c7bb1d0f68d44bab71eb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d040123-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629294, "uuid": "0bf497e4-1427-4061-94e6-05a1d2d5394c", "comment": "Malware payload (Gelsemium)", "value": "c857b9f9b8bd330e160cc3a3c274b068", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629294, "uuid": "0ecc86f8-8046-4eee-991e-6e04ff185a0a", "comment": "Malware payload (Gelsemium)", "value": "6005ecce702b84de6d46838839b2271df631ab42325b70e27324e6cabda76e7f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629294, "uuid": "16386d14-252e-4573-a804-96f9585ee2eb", "comment": "Malware payload (Gelsemium)", "value": "8ab3acc8a3f89e5b8e7a1929149d273eddadae64", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629294, "uuid": "44ebfce0-e434-4454-ac64-fe1079cada21", "comment": "Malware payload (Gelsemium)", "value": "22d131a79af91eab723065a4dd378c544da0796f2ba15733adaa6f95911ab3f0bac139bc54ae50baa23a657d066ff003", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629294, "uuid": "79b3a936-7c58-420f-a10a-564718002269", "value": "1BD4F153326703D7F532583F68D5DE334A2BBEE68815E79EB095FECA0C71A4211225CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629294, "uuid": "c080b733-c702-44dc-9091-f3939ffee6ff", "value": "9d963254953e1560e86abad0a8e32fda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629294, "uuid": "05a0e7bc-c7cd-44a9-9993-64d9174fc77f", "value": "12288:1VRrTndZohApEfPKO3CGvrKfmBzgekpw9reWpsUc7Ai:1VhTnjo2pEq1GzKoBky9SvJ0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629294, "uuid": "c44d69ca-3fab-4a11-b61b-0ae826b94723", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629294, "uuid": "12e87ca7-64ad-413a-9935-a144a2fd028a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629294, "uuid": "8a3ffc6c-00ee-453d-a8b1-aaf3f9d928a5", "value": "6005ecce702b84de6d46838839b2271df631ab42325b70e27324e6cabda76e7f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2982d54-cccd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647047, "uuid": "70a77ce5-7ec8-41ea-8a94-041b145cf911", "comment": "Malware payload (AgentTesla)", "value": "b912c0468eb8c6c31ca83a4de21ed61b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647047, "uuid": "eb8e2826-58e5-4b9d-b2b4-73c1cab9b59f", "comment": "Malware payload (AgentTesla)", "value": "60284d4addfe110a64651f10cfd4873f71b7a7e6e6c32aa3f1308a0ca7578d7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647047, "uuid": "9906adfe-d8d5-46fd-a8dc-9013c4c9d55e", "comment": "Malware payload (AgentTesla)", "value": "90cff4012407fb190d10bec7ec62639869e8b6f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647047, "uuid": "8465e6ea-16cf-44d8-8bc1-e8ecb8101023", "comment": "Malware payload (AgentTesla)", "value": "4c3c4ad68efa5b680eca834e20e021288368e985c470be1593e0419bc1b2471077956c134bb16572d20c1145eb9978e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647047, "uuid": "0bf8a5a2-bd29-43b1-ae2a-36343685bf88", "value": "74023A7AC5D68C9DC719937644D20B06EA60387658032D8FBA70EACDBCBA2F6060B585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647047, "uuid": "4cfaf8ec-bdf9-437a-bf1c-493cab9907a5", "value": "192:XRHSPFaoQBsR8hvI7kVJHR74V54OUzwztkykiy:XRGaogsF7apS9z5Xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647047, "uuid": "01b6202e-602c-4685-bf74-8a4b6ee53139", "value": 8661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647047, "uuid": "44f99849-7b54-4f95-a57f-b81ddd036992", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647047, "uuid": "246a3273-cde4-4d58-b223-ede811ce676e", "value": "P.I20210519.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3de73ba-cccb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623646163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646163, "uuid": "4ee50ab2-02b5-4530-8de3-e6511b5a667f", "comment": "Malware payload (AgentTesla)", "value": "23385ad4b5c883ba40d3fb3ada6d852f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646163, "uuid": "75af9479-018a-48a4-909f-5b800e9b155e", "comment": "Malware payload (AgentTesla)", "value": "6183f3f20771b94ae5281147422a96967c87afb10057880e4efb885a91e96015", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646163, "uuid": "913893d4-7d7d-4924-8b5e-e6b6df8beca1", "comment": "Malware payload (AgentTesla)", "value": "e45e088869bd6d10447d74e38dcfcd17741331f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646163, "uuid": "4b565fef-57cb-414b-b313-d5d9cc9c2b39", "comment": "Malware payload (AgentTesla)", "value": "5bb3e9272d7d249301c2c20fd5b85196888ae96eee631cdeacd60ca89e8e10e808d81bdbc5026bd754ab914b44cf6424", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646163, "uuid": "f561261b-4a2d-489b-adf7-4b5974b1911a", "value": "6F35C012B255C95AD43E89344072D1FC06F1EF8A6A28F74B3DC0BA6F6D72384D972B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646163, "uuid": "ae79817d-4189-4802-b9d1-7d4f6042f363", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646163, "uuid": "9dd5080d-7a43-4bf9-9cbc-0f3da51e96d1", "value": "12288:tQT8rEJzf0sf/Y9kQKhQnS9YzKRkHD/CkMyj4Dm2OWKqdI9FMkPsmB9VCZ6vP:mgrEFfKT0xKfHD/0e2OWTSFMkPLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623646163, "uuid": "2a0dde5e-9732-478a-9a53-53e746fb55d5", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623646163, "uuid": "e12fbc77-7889-40de-8de2-8760c2de171f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646163, "uuid": "857a9c71-f8f6-453d-9a2c-28b981cc72dc", "value": "SecuriteInfo.com.Artemis23385AD4B5C8.15576.4169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bcf1e4-ccf1-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623662157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662157, "uuid": "d64af6e3-6fec-4081-af77-ad7d84421c27", "comment": "Malware payload (NanoCore)", "value": "775b225a491c091a13f536d80cbb3ff0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662157, "uuid": "5acd0ffb-1216-49f8-8228-81fe8706b306", "comment": "Malware payload (NanoCore)", "value": "6221c73004cfb19cc3306528e256f7211cc1b2b53fa854cd2118a6ffc509901d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662157, "uuid": "b72a4569-ffd6-43af-94f5-fcdbf49a194c", "comment": "Malware payload (NanoCore)", "value": "695499e396f809252cf478fd9524862b0e7f348c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662157, "uuid": "5252763f-4470-4ff5-9da4-a586a891cb36", "comment": "Malware payload (NanoCore)", "value": "bb4f5d02d6b0e12b0dfd24f35ddef0fb70d934f04123fe87c67e8e1ad5123d759279ae3b349fdc9868a7aea405bf389d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662157, "uuid": "463d2581-a200-48fd-8f24-feef64d51a45", "value": "CD556C1D13A09983C06E4FB0B85DD77B06622D7AA722CA7A3938B0DE39117F41D7653B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662157, "uuid": "4064fca5-a244-4f8e-818f-babbb9b89949", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662157, "uuid": "e47b394a-7e38-446d-987f-09d741350fd5", "value": "12288:hy5SyeSNaTLMXtOt7/NiE/3Q6E0NGtCEu7aq4lQwZAgDt6qTpHfh+9VCZ6v8I:ooPSMTLMXtOt7Xg6EGhmDlz9pTpHJO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623662157, "uuid": "d80dcd5a-db28-4bec-8025-17445fd28327", "value": 1338880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623662157, "uuid": "ec77d11e-4f26-48d3-8eb3-75a820343f92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662157, "uuid": "df928d73-d3c7-4348-b20f-1be920bbea41", "value": "inquiry & products lists.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075371db-ccdb-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623652665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652665, "uuid": "0262c6b1-67b3-45d0-8e07-01ad1bc915ec", "comment": "Malware payload (Gafgyt)", "value": "c110633f2966e16e25b872ac01311844", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652665, "uuid": "cce49872-76d3-45ed-90d6-edca9db853f3", "comment": "Malware payload (Gafgyt)", "value": "6227e71665bb74433cef59eaca08931ae8a8440dcff31ba6b1872fa6763da15d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652665, "uuid": "b3a5f0cd-39d5-4c20-98ea-f1beab1bcb01", "comment": "Malware payload (Gafgyt)", "value": "e68172b55ea499d7fadd988d45d94093ed820458", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652665, "uuid": "339e8d4f-697c-407e-8a0e-00ef992e84a2", "comment": "Malware payload (Gafgyt)", "value": "7a8ed8e4cdaea8ca6cb0d1ef9a2f52a4073bc1cd199d65ae26b93bb45eabdd7568b4426f04c43450e13b27b1b0187e24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652665, "uuid": "4757a0d3-4cfe-4415-aae4-d974ef318589", "value": "02E3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652665, "uuid": "a4dd7826-a5bc-4af0-bc21-9a2ad1f4aeab", "value": "3072:OaRBoUm6Oq+lozO5hdyrzhsURxuZq+1uPNd5R:OaRBoxq++zO5hdyeURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652665, "uuid": "19a6e433-2fe8-412a-abef-549c095efd4f", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652665, "uuid": "8889ed0a-927c-4be7-9e84-5408806c1932", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652665, "uuid": "b5d53b2d-9bbb-4d64-b31c-dfeb8757a2d0", "value": "c110633f2966e16e25b872ac01311844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be49232-cced-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623660538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660538, "uuid": "bc65adba-67dc-467a-965e-d9e56fa38820", "comment": "Malware payload (Formbook)", "value": "0ae958a7fa191b572e263d9e8f4c3c64", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660538, "uuid": "93fe092b-be9a-48fd-a323-a1882d1bcbdb", "comment": "Malware payload (Formbook)", "value": "6337db7b2c4d040e1b802625a820769ad9f110f3356e7fdf1425ad283e0d960f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660538, "uuid": "15d4e454-0a8e-436a-82cc-e72d25485797", "comment": "Malware payload (Formbook)", "value": "1daa84842c476e82617d00b30e90baaf039897ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660538, "uuid": "7f1e7669-6eaa-436d-9e52-6297421d559d", "comment": "Malware payload (Formbook)", "value": "41f1e2554055332e2eac49425769de94ae358152d046dd9b2b9db0e95f683b3b0b18f13627b86a150814961aa0d1b6ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660538, "uuid": "65249ec8-4d77-48fc-9448-32267700aa48", "value": "D271862723E4C1B5E01C2E352AD3431DE079B020577746283B60782F28773042A7E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660538, "uuid": "92967156-1d39-454e-a8dd-3ba5ef5ac8a2", "value": "73bcdf876ec26f3d66df7a3f8dba4b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660538, "uuid": "c7f5afcd-49d7-48ed-9bb6-f378b21149ab", "value": "24:ZHGStuF1svt1HXdS2c5lTWflMOVRp9xNeWMRvrBL/AkKu:ZvtwsbHN1rflMiH9x8tvrBLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623660538, "uuid": "82999c38-1040-4165-965e-9a07c61c0be2", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623660538, "uuid": "ebd62a49-518a-4ecd-8a80-945cc9bc6d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660538, "uuid": "66f4815f-8839-4234-bc18-1462d49b0b64", "value": "SecuriteInfo.com.Trojan.DownLoader.origin.7477.14616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc6f54a-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623654793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654793, "uuid": "4ab99216-0aa1-4a84-bfa9-03df5e9afb1e", "comment": "Malware payload (AgentTesla)", "value": "2f8f2bbae125949418150164e865b5a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654793, "uuid": "d8d7cd22-5b9f-483b-bae5-ab8e02b1dc28", "comment": "Malware payload (AgentTesla)", "value": "63937b0c68656230dc1d68b09523f42ead63dbd3bf2c181005c75c9ed9ee64f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654793, "uuid": "e8c85ff9-83c6-4692-a0dd-e89c785a3944", "comment": "Malware payload (AgentTesla)", "value": "5f298cd148519ac74869e7fae77868b5668e8026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654793, "uuid": "54753bb6-1128-47b4-baec-4b882fa5f62b", "comment": "Malware payload (AgentTesla)", "value": "e170f44fa332c0a7afe18d3dc4910ecb5df7b424f50674afa8780ca5f3e92440f8c6f110ca56562171efdb86971041d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654793, "uuid": "6876f52a-7d67-4e71-b000-66bab646acbd", "value": "AD44121932D5C8BAED8209304B735BA6D3B6F70112D9264B27751FBA7F3C046982BE46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654793, "uuid": "a3142aa2-da82-4d9e-909f-4e1042b90cab", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654793, "uuid": "3472a9fb-e746-46cb-af4a-28a4a5fa1760", "value": "6144:8Qq+pg6ZVY07Z7TnQFqkoxz8bRBQicE12LAdz8MEp:Tpg6ZVYQYJi4bRBn44ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654793, "uuid": "f1cb8ad5-6a59-4c98-bb46-566c7c50fa65", "value": 272374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654793, "uuid": "8ae67be2-9fcc-4acf-9467-77ef6396e795", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654793, "uuid": "ab9a846d-0fa3-4d1d-babf-a38431acb7f1", "value": "TNT Original Invoice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b19b08-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623651909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651909, "uuid": "3f80a0c3-cc67-4707-ad29-165b260e72cd", "comment": "Malware payload (AgentTesla)", "value": "2c2b953e31dc61ad34588e4f8e12f797", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651909, "uuid": "5838e5b3-7191-4f09-83e1-64dc603c2be5", "comment": "Malware payload (AgentTesla)", "value": "63ae63a37ec256d4836d4e29436f43ba0475db5c223ef216dd424f115503ee79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651909, "uuid": "903199e9-272a-46a3-89be-156afe043a73", "comment": "Malware payload (AgentTesla)", "value": "7886453139c796d489c13ad36df22f79c93dda8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651909, "uuid": "22d29b0f-080a-4578-913f-3c47f9340be1", "comment": "Malware payload (AgentTesla)", "value": "997212882751f87c0d697d07a952b760b9d5209ee791d1bf1888f5c3f416a113e45a4da60b1e6766bb4e203b2d0c0d8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651909, "uuid": "52124204-a51c-46cc-b56a-54c818cb0c53", "value": "B7711AB0959C1833ED45C9F3D096BC3A0ED6F35940CB1ACA70DDD9E30B932325D58990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651909, "uuid": "cb0fe2ab-7621-4375-9eee-e589b3a18fec", "value": "48:V/6wERR7fsG1HI0vloQFLyNTSXrsUr76Tcy5IkSGURHNg0yNIpdJicMF5S0jj8f+:xNEvj1LvlogONTSXgUreTQfxmljIfnjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651909, "uuid": "62d95a68-c7f6-403f-9ca5-04d4efdc2140", "value": 3637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651909, "uuid": "9a1ee84f-d103-4895-844c-78b23c5eca3e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651909, "uuid": "fd3dc51f-917f-4bb5-b35b-e69154999610", "value": ".RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217262b6-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623651850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651850, "uuid": "aed61f57-3cd4-4f5f-b101-a3fdb82b34b8", "comment": "Malware payload (Mirai)", "value": "a2936ae9352c38059e8147be7cd343f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651850, "uuid": "d202472c-75cc-4b7a-90d3-2353acc22c57", "comment": "Malware payload (Mirai)", "value": "63af8230a623d0b628db2b2abeb4c2207cfba40605a8c1f35154bc8ba314931d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651850, "uuid": "80a8f733-4408-4daf-97a2-0461454ad41e", "comment": "Malware payload (Mirai)", "value": "755b415b9c754ea1798438e0e89548d3b9cd61d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651850, "uuid": "b1f4862d-aa64-40b4-b459-8f176d25728b", "comment": "Malware payload (Mirai)", "value": "b5ae902156f627a96ca0b0ecde63dcdd36e1e11bc5cc51ef42147ef60c47fea55208cf7c826473be5f2e08636708b98b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651850, "uuid": "f63761f4-4b4e-44bc-b115-d657a31913a1", "value": "7C534BC0B643E9F5DE020674306BEF324E36F6F6211AE987E3E4D673AC425419543A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651850, "uuid": "48b293b3-e8d9-4bc5-9065-b9a05a8fc786", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKU++eTWoTnt05HFEi7d:1jSwY4keBfrtOCQsnnF1GTNh05l37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651850, "uuid": "53f46d55-d920-453d-875c-f4ad7d329e20", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651850, "uuid": "2fff708d-f661-4905-9e14-0217cc4ebc34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651850, "uuid": "0833d3a6-e674-427a-919d-aef00ce4892c", "value": "a2936ae9352c38059e8147be7cd343f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30a01a1-cce2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623655987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655987, "uuid": "88934eb1-fd2d-4a21-b068-a6a21d8e44cf", "comment": "Malware payload (Formbook)", "value": "9e598558ba90d0afbc5ce2286111be82", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655987, "uuid": "8f49ce4c-9dd1-4613-9804-aa9fa17a3e8e", "comment": "Malware payload (Formbook)", "value": "647d2671db3201106df89364b97a5ece0ccd08ac2d6fbf62a718393c6a637c24", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655987, "uuid": "3037a658-66a2-4962-8aab-c537412315d3", "comment": "Malware payload (Formbook)", "value": "ded5f00bb6aa9be74b71854de5c2cb5d289081fe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655987, "uuid": "be82ac59-d093-4177-9b9f-1d5c8b578410", "comment": "Malware payload (Formbook)", "value": "d13c8c5913eb8db7b4b73dd57bdbab5d94ecb7ee8c7ddd8b4cc5e3d1d521c2c7d3e6646234a3a7fd62e3e87942f4f9dc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655987, "uuid": "59ccc2f8-9c61-488d-a4da-35814805a3c9", "value": "08459F9C31E6A152C78B64F0147FB42EF1BDB8AE10DD05878C93E5DE6C5895AD322E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655987, "uuid": "da16719c-2a69-46c3-983b-f49069a3fda7", "value": "1536:4FFlgqy0Tyg+fffffffff7fffNf6Eq+OkKiDtf6zrQykZr6Eq+OkKiDtfffOfPfA:4FFlDFFlYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623655987, "uuid": "c6a1ff3e-b665-4de5-bcd8-df1316882245", "value": 1222442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623655987, "uuid": "11b6ab1b-1723-4f85-96eb-1f8a7dfcbeff", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655987, "uuid": "195570f4-6577-4fab-a6cb-7d534a978ac8", "value": "RFQ SI-01.08.062021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f837ec-cd00-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623668635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668635, "uuid": "eef5b42d-dc51-4984-82da-71e7e34bb74e", "comment": "Malware payload", "value": "9a86329fb7bd48fc778676e664d3d0be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668635, "uuid": "7783bf0e-f130-4022-8511-9f7b029d7e92", "comment": "Malware payload", "value": "648071554a71aeab1671abf122cdd67da6f356853ae322534394de276b10034d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668635, "uuid": "943a77b2-592e-4fd7-9520-5ac89cb7a6c7", "comment": "Malware payload", "value": "5a28a7d26731931cad6aa63cb5968769b636e2fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668635, "uuid": "160362cb-01ea-4f4b-8f26-f49ff18201d9", "comment": "Malware payload", "value": "058ad4751b2d6600c7c5fc11f3d1753b18f8f808fe430dc451459f0fefdc8633fdb58a997f49de4b8ad85d5038e42bb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668635, "uuid": "6e4918cc-6c34-4ea1-aa86-1ed6b9f1c672", "value": "E246232566418172DBCEB331A161A231976A7C00FEFDE2EF2B85B2D61FF1AD47117062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668635, "uuid": "d5511834-a735-47ae-9244-fd4ea2da7263", "value": "9dd8c0ff4fc84287e5b766563240f983", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668635, "uuid": "d56871ca-c430-46c1-9bf3-32b14a7aedff", "value": "98304:t9pAo0zb3cdttpGl4/zgNb8Qn0NbsuO1XeK39NNXH+tCNSZ:t4o03Mdzc4/8Nb8k0V1EXeK3pul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623668635, "uuid": "e952b3e8-06c2-4137-be36-04141fb05852", "value": 5428736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623668635, "uuid": "2e280471-0759-4391-9bb1-525672d5a0e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668635, "uuid": "32d6d3f4-43c4-4272-ae8c-402a6e534ae4", "value": "9a86329fb7bd48fc778676e664d3d0be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b795ae7e-ccb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623635352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635352, "uuid": "0c8438d6-a92c-480b-8b55-71c46206ed81", "comment": "Malware payload (Gafgyt)", "value": "4012cf577e8a46ebfeb9af7d8538d10a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635352, "uuid": "b178ec4d-1590-4f91-9688-9be18157b1f7", "comment": "Malware payload (Gafgyt)", "value": "6587eab938316d86ddc27977dd1c47ac5657b77d7ccd2bad8d298f6c9f8d1b44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635352, "uuid": "0199836b-adc8-4ac1-9839-4e57e26c26ae", "comment": "Malware payload (Gafgyt)", "value": "2715ee10f903ea8cd13d3f0fb59580bde4d024b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635352, "uuid": "7c1948f6-2078-4f10-893f-9a3dc57e8237", "comment": "Malware payload (Gafgyt)", "value": "f5bb570aeb983174c9cbcbdac64913197b007d08883317a44d6ea6e03d5c823859ef7acece66be864fe87c74047f9d04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635352, "uuid": "2d20e804-df6b-411d-aa4d-0a46c249f54d", "value": "27C31A05FD404B27C7E227BAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635352, "uuid": "48be9916-f4c1-443a-b018-8e06a909743a", "value": "3072:yJDZ+6lJQTnoo3TKGbDeXUXAH5hLH1u+K2tArHqojwQQRh6RYAvZR:BDe6AH5hLH1usojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635352, "uuid": "6e0cddee-a578-4fb6-8a45-c3a12e873c61", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635352, "uuid": "6ea9d604-4b1c-4bfe-9c26-fd93fb8ff88a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635352, "uuid": "2583df58-0888-488c-b7da-787e9ff05a7b", "value": "4012cf577e8a46ebfeb9af7d8538d10a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8a8b58-ccd4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623649772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649772, "uuid": "a4f55139-92d4-4b7a-8a3b-6bee162ccdad", "comment": "Malware payload (Formbook)", "value": "92614cfd1b385cc6e38156a4ce269602", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649772, "uuid": "09b3bf5d-df62-46fc-93f4-b249f5b6ee75", "comment": "Malware payload (Formbook)", "value": "65a0e831a9a7680b0440a3afbfa71e6ddef2e2745301953e168a02ecf4d6d3d4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649772, "uuid": "421bb4c5-c385-419e-9689-2ab5073c0012", "comment": "Malware payload (Formbook)", "value": "b32113fc539912f706e55fefe7a91bb903e4d719", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649772, "uuid": "20f3ad8e-d124-4bd2-bf75-9fd8c829bcf9", "comment": "Malware payload (Formbook)", "value": "cffdd6d93d81591f99459a1fe958f9234260d6707b6561dfeaf8010f685fb9dd88ef8f8da8c48b2ae4db6f80f7187cfc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649772, "uuid": "5907fa5b-8f6f-4394-a523-97164ba98cbf", "value": "2D227D3CD618F816D221047DE01902F5EB2D405BBA03BA6B109773DD0FA2AC357C6ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649772, "uuid": "9c370da7-ab30-4d28-93cb-8e37ba7a8cb6", "value": "192:ScIMmtPOVlG/bFD+cFOf5SEzBC4vNqDs1w8hI23KJ:SPXywFDNORhlqMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623649772, "uuid": "2df75d12-1854-48e1-b04f-49199aae32e9", "value": 10331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623649772, "uuid": "b21ffc4d-a565-48fe-9efe-c3639a0c3044", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649772, "uuid": "4ed93129-7c76-4f1b-bee3-f4ae5d2fca0b", "value": "Swift_Payment.MT103.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abcf741-ccf7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623664751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664751, "uuid": "a5a43572-23fc-44e7-8b9d-133637304fcc", "comment": "Malware payload (AgentTesla)", "value": "46438b6960a9c077e688808eb77745d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664751, "uuid": "59c4d763-b008-404d-a67c-4ea334f2a5d1", "comment": "Malware payload (AgentTesla)", "value": "66ef19869cc0e277c1ea2cb8ccac219b4c3cb20dc720ba75914e70d6d39ffc9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664751, "uuid": "2805cb18-2281-47ea-b732-b677eaef4b58", "comment": "Malware payload (AgentTesla)", "value": "9dd4127bb9ad6137e81d93b8b40f98ccc49255c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664751, "uuid": "0bd7d012-3922-44d5-a1ba-a2e7dc39e2d6", "comment": "Malware payload (AgentTesla)", "value": "0acbe429ef4660d689e9e318e94497b0fd7c0f59c78c3ddb791a8554398a69ef5dec65b62e624620ba1ffec8916b7b9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664751, "uuid": "1169e558-008d-4651-8bc7-711583516d86", "value": "4005E02613C88B52E97E4734D265409093F1FD2BD329EBCDBE9954CC0BA0F818762B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664751, "uuid": "bf96dd92-7b88-46b8-b793-fad22c158e88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664751, "uuid": "0c1b074d-be92-4dd4-9751-b42a96cd1260", "value": "24576:wWQTLM1ZcIYj8vHBn8BgkC6k8xVvfRscnK:6LIZEjIh8CkhvZsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623664751, "uuid": "71ce061f-87a7-49a9-b5e9-d88ee48487b7", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623664751, "uuid": "daa4a333-ac5b-4be4-8103-08a4ad932c75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664751, "uuid": "6dba8c43-c417-4852-9000-716d0f46d906", "value": "20210614__001901001001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7f5c2c-cce6-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623657694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657694, "uuid": "4faef6d5-4921-4a0f-8581-f9aba9dbc645", "comment": "Malware payload (OskiStealer)", "value": "8a1ec1e2f523756f8475c0744166dcf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657694, "uuid": "5b06989a-fcd9-4b63-a15b-5cd52ba913fc", "comment": "Malware payload (OskiStealer)", "value": "675119d67d4659afb84fd4daab894bbd4f2fb02f95ef8c3303469a647bf09358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657694, "uuid": "87062e28-6c16-46a2-9644-a8a5e2851086", "comment": "Malware payload (OskiStealer)", "value": "b6ca7ff67e92a0e50bb5dc924eda90a82c331392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657694, "uuid": "5e440fc7-ee7d-4a54-bce2-5ffd0f130502", "comment": "Malware payload (OskiStealer)", "value": "b5be0f1f1c9e311b379f9c7c05c25fd0052ad207061f68ff0ecd2b05a9d2a2e9f145e8352cae9e4e7cc30bfa7c74200e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657694, "uuid": "83bc9a98-8cd4-4fe9-a3e0-71c7db584306", "value": "C5341255B8D2C5B3E6111E31277B97BAD7F6FA2132F229172F1A0F587B101428E152B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657694, "uuid": "67063ff3-f531-4121-94a5-08163f60f445", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657694, "uuid": "5a51514f-4838-45b1-a3b4-efe93da9f6b4", "value": "6144:ksZRnuPK1EPce01lClljvQ4ph24agfhlpy:3qbn1dDph9agfhlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623657694, "uuid": "6d179b2f-0b5c-409c-9d0d-fe7e03738a0e", "value": 247997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623657694, "uuid": "71fb008d-c0e6-44f2-9444-9fab2d487bf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657694, "uuid": "714bb573-161c-45a0-975e-e409c494247b", "value": "order specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9d645c-ccea-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1623659310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659310, "uuid": "fc5b4f6b-6d94-41ee-872a-070fcc52944c", "comment": "Malware payload (Gozi)", "value": "88aac7156709fe6bcbc3041e9096428c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659310, "uuid": "b85d9994-83ef-465c-a2d9-d1e7d1693cd2", "comment": "Malware payload (Gozi)", "value": "68439b0576f9fef2556d873fd66ce10603b38b3fd7ea9e9f796205cd763bb90d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659310, "uuid": "de328390-ea12-440d-85ff-66247d3d6d42", "comment": "Malware payload (Gozi)", "value": "7e37859d216eeedb0b731d4bbf4fad4bc3961b5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659310, "uuid": "ebeca153-daf6-4f55-a4be-a6ef81235523", "comment": "Malware payload (Gozi)", "value": "dd455f859c6b89cd9790e2380a0b0fa1b554e377a521cf72fc00afa6abdd5568b6a2ba2bbc0d1d4f7f082b6e3dc38644", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659310, "uuid": "0a9b3522-d9ed-47e6-8fd3-9460ef3f48c2", "value": "B215C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659310, "uuid": "8ba3e355-5a2d-4b76-bd35-2779d9207f67", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659310, "uuid": "294fe13d-779e-4610-b780-6ce31a7b4393", "value": "24576:HQfpzjXPgfv8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgDJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623659310, "uuid": "b456faa9-9b32-4d1c-add0-b5d35f1bba73", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623659310, "uuid": "006a50e4-332c-4ea8-a993-b38197116464", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659310, "uuid": "387564d5-e5a5-4904-b065-229db2a47fdd", "value": "88aac7156709fe6bcbc3041e9096428c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01515642-ccdb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652655, "uuid": "8b1c2104-a1b1-4f73-95eb-dc3dd29d7c7f", "comment": "Malware payload (Mirai)", "value": "2a559d3affd695b00e8e5a0d09cacaf5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652655, "uuid": "ad79136f-ddb9-44c5-bdc4-bd7bae857130", "comment": "Malware payload (Mirai)", "value": "685ae3afeac2e95a8f3d65432bd60e0aaf2ba2ae1ba2889b3e3dfb3fd1a2d544", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652655, "uuid": "be7288ad-dffd-4f68-8ef8-a192324e2964", "comment": "Malware payload (Mirai)", "value": "7c97384978264f2eb66c44fe84967f0a498884bc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652655, "uuid": "9fc0cbf9-6c80-4791-9ea8-4b2474093f27", "comment": "Malware payload (Mirai)", "value": "7858e1d7c459d542fc03aaad96d55d03bcf23b1ebb86d7e882aa09a10e365de122aad14438bc3d6b706ead272d2741cd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652655, "uuid": "df5b5bee-eec8-4d9e-81b7-d4ae47932722", "value": "ADF3181773E1C8ABC05356B82ADFA6E29910FD7C1632615B33D47E683B3D8C82969743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652655, "uuid": "3b92c784-e67b-485c-9377-eac413197359", "value": "3072:2Bfrx48dXITpOIWPN654nAgQOel4SzdAP46tqHikmN0sVhHzDkp0rN:CfTfrPN6sAg3eGrQ6YHikmN0sVhHzDkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652655, "uuid": "99f8198e-232b-4572-91e6-2cd062489336", "value": 158099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652655, "uuid": "8e270e4f-5e35-41f1-86dc-c9085cf6f2a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652655, "uuid": "07526bc5-82c2-4f6e-a174-8a76a76e63c8", "value": "2a559d3affd695b00e8e5a0d09cacaf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dac3e1-cccc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623646328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646328, "uuid": "22de345b-aca0-45f3-861e-ed873fbf200d", "comment": "Malware payload (AgentTesla)", "value": "275b6fd1d9c310d5d07b63516df74f2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646328, "uuid": "0a5ab30c-0df7-483d-aeec-70aff8708639", "comment": "Malware payload (AgentTesla)", "value": "68f5b9b644d123f8a529904d74e2c04ea00161ef61bdc5a1f8ec0bb63d44ad22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646328, "uuid": "7af3f35a-a1ed-4c1d-8b1b-08c0e4dcae7a", "comment": "Malware payload (AgentTesla)", "value": "757687ce490c9f17a37e9f680293944a83c54d11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646328, "uuid": "6d423e42-010a-4004-93e1-fdb485e1ce92", "comment": "Malware payload (AgentTesla)", "value": "7ec613102f22effced7b324c43df380af5be6aaf3e22d727d2aa9b1b6cb100e19617c449050d8a0c900d7b8ca971f936", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646328, "uuid": "f39b9dfb-fd04-432b-96fc-fa4f1f24afa2", "value": "D305127C53401E2FC1A996B882D044015B78EE05373BAB89D442B5FEA7733F44E6AD9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646328, "uuid": "69d6f5c7-f5b0-4486-88fc-087520b12f97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646328, "uuid": "b6f85870-d37a-4143-ab7c-b5aeb2bd46da", "value": "12288:P0ZZM4e/ZUdtbU7nSsLLdTs4Xp/RbdBBMKV8x/XrWsv1iNN4auBwkSKDVJueiEKB:8NeBUdtKnt5L5XBMKGlqnjkHkGtuVPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623646328, "uuid": "4b9f371f-1262-47ad-8bd8-5381f527a77b", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623646328, "uuid": "f85b29cb-af3d-4168-a272-5469f04fdf5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646328, "uuid": "0668e145-f8e0-4323-9776-b2c27f28b503", "value": "Seoulkorea KCTC International Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb892e52-ccec-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623660269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660269, "uuid": "a903fda0-1189-4f12-9ba4-7e6c78dc7ea5", "comment": "Malware payload (AgentTesla)", "value": "2ced81e8a741391689d97321f49d4b34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660269, "uuid": "cbc31548-a206-4037-8df8-f3f2fd8543ab", "comment": "Malware payload (AgentTesla)", "value": "6920384d9876392a0ad476b75c5c45fec3933d379fada76802968e98c8184ed0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660269, "uuid": "0b767aad-c242-4158-9b49-03816a71d7e6", "comment": "Malware payload (AgentTesla)", "value": "eb41ce2e5e7e0c53522bb871edee7d50aca1acbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660269, "uuid": "104d6922-6719-48de-af9a-3cf2fd8862b1", "comment": "Malware payload (AgentTesla)", "value": "234f51f5c839f3a3fe4da16d5add91794f948a0972b0beeb2366fd01962648168fea692eef532b1494fede0b9379db3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660269, "uuid": "f2582a2b-d4a4-427d-8bd4-54400279a5d0", "value": "F924128DB3CA58FFEAA209B0177BA732C737611556E9095F2B481F7F16282D3940E463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660269, "uuid": "65c11ed0-c2d0-4a51-8741-d38b2aa36746", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660269, "uuid": "002acb2f-d42b-41b1-b90d-c507600ecf50", "value": "6144:Ds92C57INtqSIyQwB6CSIs27YWySbNUeTROj64qMznBST:y2C527Iyd6Cjo0Om4qMnsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623660269, "uuid": "c2ef3d7e-079a-4ba3-81c4-15f98dec3510", "value": 227300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623660269, "uuid": "ffb863dd-5e42-41e7-a499-92542f0d44df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660269, "uuid": "8b9882d0-dee6-46ba-b8bd-5da109f9e011", "value": "Shipping Docs.Commercial Invoice. Packing List. Bill of LandingTHS0094587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9162282c-ccd5-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623650320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650320, "uuid": "17516410-db58-481b-9b75-75b19e850e3e", "comment": "Malware payload (AsyncRAT)", "value": "3ed4d31b885dd3774d71dc8111967fc2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650320, "uuid": "41d5ba28-a5bb-46fb-b4d3-3d0cd492c201", "comment": "Malware payload (AsyncRAT)", "value": "694e711ba8242d75432fd704b886fe18d38269bf9534cbaf825d127d9ccc6668", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650320, "uuid": "896d2635-a874-4f45-8e2e-48de98a61ebf", "comment": "Malware payload (AsyncRAT)", "value": "09c7306d70531eb5b2bc89333d0e2bc1671bcc47", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650320, "uuid": "db2f9e04-f8a9-4638-96ac-088121fb80b7", "comment": "Malware payload (AsyncRAT)", "value": "a6270877adcb0183355a92d9546fc2fa2f312da87e7ecde4ec245889af300f50d73b250ea821d6877ada6d576e22bd92", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650320, "uuid": "f2e2345e-35f4-4a8c-88ea-a4c987c6e01b", "value": "1DD4BE216E488BD1E0BE737D51D4001823F7EC1ED712DA8DBC9079DA1B3AA81CE7795A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650320, "uuid": "4e0270c4-f335-4f3f-b813-ab2dfac5e0f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650320, "uuid": "1c9a6fb3-38e9-4967-943d-2f149dee0378", "value": "12288:Vn3OUDqxYM9iIfFKfffBhhPUt6MaSNGkGxFtUD29/6AlyK06OQdwaZM4e/ZUdtbu:VfJhWtB0kGxFtUD2MAu6bFNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650320, "uuid": "16f5c823-aade-4ea4-a090-3f91c225a933", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650320, "uuid": "85b3c333-73a6-4b92-8990-ba2d02762cd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650320, "uuid": "5ddb1e51-b83c-4d58-8c6a-388ed72fa0ce", "value": "Q pending invoice ESAS Kurumsal Danismanlik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88efa98-cd03-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623670250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670250, "uuid": "88bb4590-7bf9-45f4-afb0-b6f2098598f9", "comment": "Malware payload (SnakeKeylogger)", "value": "6b76afaa8959f41c970c25a74fbd3cb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670250, "uuid": "a1b75f8f-5f0b-4bb2-a337-498063830902", "comment": "Malware payload (SnakeKeylogger)", "value": "69d90566c7028dc5d95f83e7961fe95d62da5a5c1c0c5ad0ff0c100f03773848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670250, "uuid": "bdc54068-7adc-4976-8f83-f3a80ffde2c4", "comment": "Malware payload (SnakeKeylogger)", "value": "8ad7e603bedc6f13bdb45f85e3a30e62c5b2e3db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670250, "uuid": "20e03b0e-5318-4f55-a79b-39932e8f2aed", "comment": "Malware payload (SnakeKeylogger)", "value": "ef4e059a3b162aa12a0239dd863682a7f39c5e9f53c5dbd6dda71dc84f33f2e3f6d2f830f83b85a65d3e46761789493d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670250, "uuid": "3b8236f6-2317-47bb-9cae-e9ab0ca8460e", "value": "D6459E63B24C9A5EC018C974643390F842E4DF8B6904EB877DD4FFAF6EB124AC9566C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670250, "uuid": "9656ff67-c3b0-4f83-bf0f-a68b0c696c70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670250, "uuid": "82e228b5-4f53-40a4-bca0-12395605280a", "value": "12288:IqvSbseSLymimXZPwVjq6rkJmZYZeyrGPajvRGtFTgkdH8ALzdNcVMkPsmt9VCZp:2QFwg6rfCrGP6pGtFkkdHT4VMkPL9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623670250, "uuid": "d5004c0a-1a8e-4a57-8ac2-ac1922137ddd", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623670250, "uuid": "523d55d5-659d-4f63-acbc-79a000862a6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670250, "uuid": "4477c5b1-7f6d-487a-95cc-71d68dc9c73f", "value": "INVOICE SC1289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2acde4-cd16-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623678037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678037, "uuid": "1cf94cfa-4860-4645-bc8e-05f35286d7f4", "comment": "Malware payload (AgentTesla)", "value": "82b53b77fb2894377271d84c54d89661", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678037, "uuid": "b8164f88-2a98-4bc1-94bb-dca85c4ac71e", "comment": "Malware payload (AgentTesla)", "value": "6a442fcd8675b5b685f7974e34b6beecadf7afaf6fa6c8259fb5e3b6818a9eb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678037, "uuid": "268cb498-458b-4124-9ee8-ad306957723b", "comment": "Malware payload (AgentTesla)", "value": "81a221e82838e9f3a897ba694d0e7ad9c6b50dc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678037, "uuid": "608cdecd-070a-43b0-9468-6ad4ca24ef24", "comment": "Malware payload (AgentTesla)", "value": "143dfaf81f7b8aee1f72f9d84495ec9b1a6563d93d5e1af4980f6dd4c9d0c6a57d091b19deb23b7287d1eb28cb5cb0f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678037, "uuid": "156e93eb-922b-4d54-b24e-49f8a8226282", "value": "AB15BE534ECF866AD2644DB56B71EC4781325CAA2948B3223EC035BDD93B1EDD8EF502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678037, "uuid": "eda064bf-81b3-4c1e-a18a-537a9c71c352", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678037, "uuid": "bb2cd3d0-dccb-40e2-9f3b-90c90615728a", "value": "12288:XSMPQipP5wWzd+QIS/E5RGmLkMdSjks8qgxfLjU7EtR/NNUll6U:Kippzw/J5RyMdep8qmDjIyNUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623678037, "uuid": "46dad49f-adf1-4f39-b2bb-55c901e8ba48", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623678037, "uuid": "47ba0c8a-b3cf-4306-9760-7f5229f307a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678037, "uuid": "314d94b0-adfc-43a8-ba4e-b9586fec3df1", "value": "T\u00fcbitak Ume1 S\u0130PAR\u0130\u015e 2021-1406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a480f2c5-cce2-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623655935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655935, "uuid": "8bcecfa4-5990-4f94-aa08-55cc999e5a36", "comment": "Malware payload (AZORult)", "value": "4963c2b79bb3d8377f4fd733027394b1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655935, "uuid": "a00754b2-2a85-4ff6-936c-d3a389144db1", "comment": "Malware payload (AZORult)", "value": "6be05744bb988c292d9de6d080efac94f23e802e05e865672d3b285112cee48a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655935, "uuid": "71305c11-538f-453f-980c-5812b8e14f54", "comment": "Malware payload (AZORult)", "value": "0531f1105c9833d3781e31739376cecec5af3ef6", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655935, "uuid": "917d0d9e-cc97-4222-8ede-45ca4c15142c", "comment": "Malware payload (AZORult)", "value": "9d3d261de1fac2f874fe78aa96631726c74f22c16d24354b1e1ebaf956e4b2713babf3cea7a58e6e7c484a7af3b753b9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655935, "uuid": "710b2705-f3fb-402a-b8c5-00c55908497d", "value": "7325AE9C30D6A152C78B25F014BFB01EF2BDB8AE10DD058B5C93E5DE6C6895AD312E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655935, "uuid": "2f785d66-3dd2-4619-b7fa-ff7224fca79a", "value": "1536:4FFlpTblKbp/uuuuuuuuuBruucuj1T/PVzL68ujqiZbVgij1T/PVzL68uuuPueuv:4FFllFFlY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623655935, "uuid": "a45951ba-98c7-4b3b-833d-4d8b88676004", "value": 1055305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623655935, "uuid": "b8a9c985-f481-4b39-bb05-d239f93099cb", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655935, "uuid": "c1c321f4-022b-4a2d-86e0-03c7c0ec7433", "value": "RFQ#176220621.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b47b119-ccde-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623653960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653960, "uuid": "41cd4959-02b1-4e44-861e-21125d33c78c", "comment": "Malware payload (AsyncRAT)", "value": "2189974a8865befee2727c125ed4b04f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653960, "uuid": "14bb1b3c-921a-4fae-804d-82baf2356e2e", "comment": "Malware payload (AsyncRAT)", "value": "6e45950386612cca6e511df2411c9b85c1adfbb4f974c5220c39113ada676414", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653960, "uuid": "a0df370c-9d75-46b4-aaf9-0199005fef94", "comment": "Malware payload (AsyncRAT)", "value": "ecbbb3199cb9f28d93f145f651906ea02ec893c7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653960, "uuid": "6a8a7259-0112-4664-971e-ca4012067e7a", "comment": "Malware payload (AsyncRAT)", "value": "10f777426494a4f4e8bb342959d3bbc4dc1620382db82a4cbef78da2c0966b8d1bba2b02bf4ca4b4971114c003a92c74", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653960, "uuid": "eeec557a-63db-4fd1-986e-53cc71e6ce48", "value": "18057CF4F59899B1C15ECB72C7909CAEE7A111FE5303891C0AB9DA8C1F0379A8F9D845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653960, "uuid": "f45c3cd3-8dbe-4ccf-8803-bcd1bce7968f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653960, "uuid": "59d7da41-112c-4b2a-afbe-01637832e855", "value": "12288:goy2OifqTvTS9D8SmYjlHtb1gb44E0S4zSPgguZKJcDfXY5azURbU:goy2Oi17l1gb44E0lGPqK6DfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653960, "uuid": "5cf21ce0-6728-42f4-8a43-a0221c6ac1ae", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653960, "uuid": "6d73fd5b-2656-4a32-a027-6f9bbcc2c216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653960, "uuid": "9b02f0d1-cc09-429c-875a-c39a89d90c66", "value": "21141007 _21000122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141881b3-cca5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623629494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629494, "uuid": "4342af7b-9bc0-4ecf-be4a-6f6a22cb0e5e", "comment": "Malware payload", "value": "9cacec575782d7b25a94f10e2061ac4c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629494, "uuid": "c42eda54-00be-4e80-8278-d1feb82c40fa", "comment": "Malware payload", "value": "6eaeca0cf28e74de6cfd82d29a3c3cc30c2bc153ac811692cc41ee290d766474", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629494, "uuid": "4f1f0408-660b-482e-9fcc-20e3e8bd3c49", "comment": "Malware payload", "value": "366a9e646a167fcd2381bc15905f7d7a5e76a100", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629494, "uuid": "cd09a788-e378-400b-b03d-1a92f096d795", "comment": "Malware payload", "value": "a2764f888fccb037cf39ec62ac7208ecbcd589e304eef6bc5c5b22c3077718be598db860845a115d8f1701bdfdbe23cf", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629494, "uuid": "20b098e4-e987-4cfd-819c-c347e650e8fa", "value": "FCB3282AB3A542A1E423E5B6DAEA9657CB7130001F304B9F0754CF5A5F333A5ED36E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629494, "uuid": "b0082301-5dbe-4d49-b4aa-84ac8dfbf5ca", "value": "f55c398bba92f9fd68ee027455e10d94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629494, "uuid": "aab99cda-890f-489f-ac40-0605bf146edb", "value": "1536:t9/mGK4ZA1Cu1Ytn9Z3dRf64YJQEhDJpgr4GWF1go2x1va7WKVZF+kNkB7a:X/mGK4ZA0uk9fwJfTO0F1iBa7brFXkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629494, "uuid": "e516c17b-f168-4c36-8001-318be4ff4b31", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629494, "uuid": "03c0bac9-ff55-4c5c-acc8-d96d42f1e1e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629494, "uuid": "b8557244-61bc-46ce-addf-8a384a22092d", "value": "6eaeca0cf28e74de6cfd82d29a3c3cc30c2bc153ac811692cc41ee290d766474.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29317ea-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623647423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647423, "uuid": "f42407c0-d296-451d-9902-37c54cdb8757", "comment": "Malware payload (SnakeKeylogger)", "value": "489514b2ea9277bf1c30f6c44f495389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647423, "uuid": "18dcb237-9db1-47ca-befd-cab31f162e97", "comment": "Malware payload (SnakeKeylogger)", "value": "6edb91362706bf38505d4c2d2a1453be778d90779f40740cb53fbaae63064bb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647423, "uuid": "f9a533c4-63cc-40bc-bc7f-952239352abc", "comment": "Malware payload (SnakeKeylogger)", "value": "b358a8c4f245157c69df1008f9bd5416c55f1507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647423, "uuid": "e2d1cb06-6b0b-4bbe-9054-c806a2b60869", "comment": "Malware payload (SnakeKeylogger)", "value": "9e9bf0080598078acfbbac590ca86c39b1d6c0d0e6312067c868280ef2f4b677782c896f9d0ade94ee46cb431c13242b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647423, "uuid": "7aec3769-acf1-4de3-a73d-cb719fa1e098", "value": "7644121F70E2D9A7E49563786877833DDAB3AA040390156F9F00AFAF2C17613FA15396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647423, "uuid": "241ae348-e1cf-4eaa-8792-9fc4913a7d13", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647423, "uuid": "0c7a328f-a459-4dbb-bd0e-92e285802741", "value": "6144:Ds9GN2SBodSDQIi7YQJ1M2e/vTUQPPyXExkpAuA1Vnl:yzSpQIir1M2enZHEEHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647423, "uuid": "a5b323a5-016d-440c-b075-62378296a5ab", "value": 261734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647423, "uuid": "ebbe0717-ff1b-4040-8c27-29880c56380e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647423, "uuid": "d7146602-4d0b-404d-96a8-acbde1db2600", "value": "INV 8462924546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7349bf2-cce1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623655618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655618, "uuid": "6578413f-1e54-4fa4-ad64-7801d4cff9dc", "comment": "Malware payload (AgentTesla)", "value": "49636f66b351fc1d34d5fe1dcbde31cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655618, "uuid": "ad65649a-01fd-4b9d-a685-c29606c13ba6", "comment": "Malware payload (AgentTesla)", "value": "708a18ef69b6f283525326c42cfb42749e5eb5ba530911c958d44bed23dbbebc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655618, "uuid": "fc29c49f-ade2-42f2-b1d1-88d8c656212c", "comment": "Malware payload (AgentTesla)", "value": "3d21a32df3be480144df8b038793872ce5a085d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655618, "uuid": "16175c34-615e-4f02-9ad9-72b1721a4e08", "comment": "Malware payload (AgentTesla)", "value": "ab9cd6101f8f2dac6660aaac30eb938c6a7931f4483b597bbd522986d09f41ea73fd8434a0aa907e0239ca8c253c6a14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655618, "uuid": "7628ebf2-e183-4bfa-9167-023ec88c273b", "value": "21A402043AE9902FE1766F7F2EC07A44D5AAF9763A07F14B3456124E0A47F90DD43A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655618, "uuid": "31250823-4f8b-4ef7-8a22-4d8c9018a8a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655618, "uuid": "f0be8dd5-eb52-4e1a-83bd-0332a4b0463b", "value": "12288:nQSr5xh0dc7dxeO8wKKxGCLFIwTloiz01mLpChE:QSrN0qZxeO8YGCLFIliAAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623655618, "uuid": "b74d7934-8948-4108-b9ca-622b8222aba3", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623655618, "uuid": "cc26ac13-2b68-417b-a2c4-26764bbea96f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655618, "uuid": "128a86ef-7c7c-4450-bdeb-490aeb875394", "value": "PURCHASE ORDER FOR URGENT RESPONSE PO 845-7265-5188-1250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cd0499-cd11-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623676018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676018, "uuid": "fb2b232d-6d0f-47b3-886b-d87cfc3dfbad", "comment": "Malware payload (SnakeKeylogger)", "value": "2353ccd707a2f205cfa9f5cf42d8d25f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676018, "uuid": "1bcda338-cc11-4374-b067-da004b27a58d", "comment": "Malware payload (SnakeKeylogger)", "value": "70aee1eee6d4ce83ba378cc85883a3bc0132b9d8adccd8946d65fcd9e6c4015d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676018, "uuid": "71ba9858-c94d-41af-9c59-73e6edbd1420", "comment": "Malware payload (SnakeKeylogger)", "value": "8c5a0f049fc55385becc76cba6b13c810ffe86fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676018, "uuid": "7a393975-2628-4765-aaea-099c7761428d", "comment": "Malware payload (SnakeKeylogger)", "value": "0194fa2bd334d0f3b69151592f356f5e50e46503a19af1b9c1841818901e3c6fa0d826a6ead6ec3645c980855ddf4e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676018, "uuid": "cb1c7158-d3d4-49b6-9fc4-8c1d6477e0b3", "value": "C544AE6D3BE89900E6FF8A7215714192CBB5F8520967DE0C07C0B46D3E3A6818E5AFD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676018, "uuid": "262ab970-7ce8-4d0d-b08b-64d497bd7e41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676018, "uuid": "6a295448-0204-4b3e-acd5-8e4da3a485cb", "value": "6144:uM2xj+6uRuLuRS6on7G3vCSLtSNJxVNN2CvjVuUU74b/:uMD4gSR7G3KS4JxbNFjVu1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623676018, "uuid": "b1b42a06-804c-47b3-8efb-a50d12efce65", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623676018, "uuid": "9dbc84ff-f4da-4083-8395-7744277a03eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676018, "uuid": "6fb959a6-6b08-4d53-89a4-da975d54de0a", "value": "StubV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd04c31-cd4b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623701020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623701020, "uuid": "0ffb341a-ca98-4a5d-9288-ca40a53e4c24", "comment": "Malware payload", "value": "b2f54bc0a32e33442de880e76d671cdd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623701020, "uuid": "25d7c72d-ad00-42aa-a2f3-792b986cd593", "comment": "Malware payload", "value": "70bc6c09d1d2722733a0a4980ce3e8f845257964bc877d8873f4b6d740b2be97", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623701020, "uuid": "db6c994f-b865-4648-bbb5-fef8dcd03c7b", "comment": "Malware payload", "value": "c97620c29e9ab8a0b5b519f31f7059e41b1b52e5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623701020, "uuid": "0c90dc8a-d655-4ec2-8cc9-7baf69f4dfff", "comment": "Malware payload", "value": "aab10987f19438aa6f18731e0a7b09eceda39de033ca8b19608c142f4c73c072c2774fffdeb90ab7b010e922e3a77bc6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623701020, "uuid": "fada905e-4d98-40cd-9312-8c1836b744d7", "value": "9B13F1670B4EB4273575EAFC67C47909458E9ABE7C44C68DE4F634248FA449803868B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623701020, "uuid": "c77607cc-d4a6-4e3a-96a9-c1865de59fba", "value": "768:VUJQt4CipYZDyUKz6/lLZZ0jIFGegJUdKK9uZR/MvqVs4RFaSwwCN6w8rqyFH:VWWZpyUx/VZZ0jIjgJUdKK9O/Mv+jHaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623701020, "uuid": "60724541-8321-4a23-ac17-78584cf5b731", "value": 41558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623701020, "uuid": "d3757043-14f8-477b-963b-047dbc8b9d92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623701020, "uuid": "b5ca5dc7-0343-45df-ab88-ad7a13f621e0", "value": "8710ad8fb2938326655335455987aa17961b2496a345a7ed9f4bbfcb278212bc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b7ad18-cd6c-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623715000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623715000, "uuid": "fc315b1d-d3f7-4693-be6b-873719b2d5ef", "comment": "Malware payload (AZORult)", "value": "2eb654cf18b0ca39a2591f0c7935e379", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623715000, "uuid": "3740c5e4-f86c-4ebd-860a-041d8ba6095a", "comment": "Malware payload (AZORult)", "value": "729aed68e87f7917ccbac1c57451fbdc10c60e66fd140a98763828b27b7da687", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623715000, "uuid": "a75adce1-c242-43b0-9cec-8ee0b9f6292a", "comment": "Malware payload (AZORult)", "value": "539cc2c6a880adaf8f3b610b9f22464564162982", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623715000, "uuid": "e34819b3-c3fd-4257-b56f-86fc4a90c0ee", "comment": "Malware payload (AZORult)", "value": "d8bb7070b9c6bef2065768a548cbb7559150b9be4c894c9ed1857562e1e82b0135517d80280fecd28173f81225f0934b", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623715000, "uuid": "c60b3b56-6e8c-49c9-97da-9e7aff60fd56", "value": "2D15BF534ECF826AD2744DB5A771EC8782321CAA294873212EC075BDD9375EDD8EF902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623715000, "uuid": "7251fc4c-30b8-4678-9dcd-da8e22830a5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623715000, "uuid": "cc1b1caf-1128-465b-a7a1-7f81a1693363", "value": "12288:BWWSMPQipP5rmIQGcoqMwaSLSr8Twlw1qMD+6HIqOUpcD9f1fJ:SipwpG/q5Or8TwW8My6HIrUpC9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623715000, "uuid": "e49f5f53-5022-4fb8-b361-52cfefe2dd51", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623715000, "uuid": "07008ee6-6a59-4a11-83b4-83c906a908ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623715000, "uuid": "3cc8df94-03fc-42e2-8058-6d0e610411ca", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb539c1-ccb3-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623635659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635659, "uuid": "9a44c3ee-5bfb-4e12-aa80-fe406a3f2b70", "comment": "Malware payload (Gafgyt)", "value": "22f9517b4a65fc4fb14d98ab202a1caf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635659, "uuid": "f3013046-6280-47c4-b537-ca30609fe95c", "comment": "Malware payload (Gafgyt)", "value": "72dd3ba287ef8ae0f0044c739f23097a5198e74cb70bc9ca3c567cc2e563ebc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635659, "uuid": "8b0b7ae2-68e8-42db-998a-48a9b361d55b", "comment": "Malware payload (Gafgyt)", "value": "e336dd3aa0037bd50a98bb7ad7f22abee683fe0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635659, "uuid": "846ec0d0-7ea5-457f-8999-0f16a398c69f", "comment": "Malware payload (Gafgyt)", "value": "9299801a03464d1fbd3104310b81edd8eb1eac97f73674ee1d15f59c7dad1058d77ef339da24919f672fa515f0c0aa98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635659, "uuid": "9a5f60b9-8703-4389-a6f4-6941e91e551c", "value": "6DE3766E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635659, "uuid": "136fc141-c754-4e24-9d9c-8f2e8b7fd9af", "value": "3072:4bp7NxDGvCazfp5hKmEOKRsURxuZq+1uPNd5R:IFOBp5hKm/URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635659, "uuid": "849cc590-4087-4950-bdff-881e8ec3cf29", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635659, "uuid": "bfc57236-e08f-4e62-b023-7615b440d946", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635659, "uuid": "273c5380-4e94-429c-b90e-0dee218298cd", "value": "22f9517b4a65fc4fb14d98ab202a1caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0285f0b8-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623652228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652228, "uuid": "8d0a6f2a-15c4-4a0c-afb6-c9b81871a949", "comment": "Malware payload (AgentTesla)", "value": "f6ed0e8db32e968d1cff9bb8a29490a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652228, "uuid": "4bae09be-0ef0-4e09-a16c-fed8ec6135ad", "comment": "Malware payload (AgentTesla)", "value": "7306aa364ac8d96e459e1039aea904e4987f9b7e191b64830fedcf0319929210", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652228, "uuid": "ab1acd5d-9ecb-43d3-90c6-0237f16db03b", "comment": "Malware payload (AgentTesla)", "value": "19ef7de64a07c965f748d456639a882ea962302d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652228, "uuid": "42f8fa3f-7adf-4ab8-83e0-123cb06fe6a5", "comment": "Malware payload (AgentTesla)", "value": "72201d38d4de465486a466de496e329c8e5617b1acea281965fe61e2d3d78b130275c4bd0feef850addb8291e11eb2ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652228, "uuid": "f86fc620-fdf3-46e9-9341-6e3b7cb9f268", "value": "16659D2237D8A51BE27E96707574050983F6BE4AD562EB7EFD8871CF09F1A009301BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652228, "uuid": "10c242cc-becf-4813-a997-584b3bcc7867", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652228, "uuid": "0a0e32a2-07fd-44ec-afe0-57d3e8a80368", "value": "24576:4Y7Uhd2WaUVYtXiZmpFN7CeTDyQ6q9w7s6ABGmJ:2D2WaUYtXiZm5CU6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652228, "uuid": "4d40102f-b29f-4e19-887d-8bf750957393", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652228, "uuid": "a486d2ed-8c3b-4649-af1f-be939225b184", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652228, "uuid": "f8141e54-224c-4892-b319-e98aed632125", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2343cd8-ccd1-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623648657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648657, "uuid": "e928b519-0864-413c-86eb-b3a0c3ff9ce6", "comment": "Malware payload (NanoCore)", "value": "fc6a06332c581b5aa4cff82f4102b833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648657, "uuid": "36b311ff-595a-4642-9c21-c1fbedde14b4", "comment": "Malware payload (NanoCore)", "value": "73662984d71a5d721274bd1b5ac416730f76260b459156a983290e6b92794d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648657, "uuid": "d3e7c93c-66c3-4293-bd52-f5772c6e1931", "comment": "Malware payload (NanoCore)", "value": "4b4f0cb617b2d0c2f7c1b8d60cd5be491aa199b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648657, "uuid": "46eb9821-bc9f-4d25-8d53-70eeb70dd16c", "comment": "Malware payload (NanoCore)", "value": "91151ddcee39f9ab3aa7503f370d104fcbb0ac5fb93c29800b4281d8514368c3cbcb27e1ab5818f6e240054503255fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648657, "uuid": "9b009bdb-a229-4445-9c3d-4a043e6e482c", "value": "B855481169304419ECEE4DB0402992EB0AE2EE4B6614A56FEB807F1FD97134CFDDA6F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648657, "uuid": "b34d150e-13ea-485a-ab2c-5ed7091c4a31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648657, "uuid": "bcd9f60d-733d-42f3-9f11-b8da859282ec", "value": "24576:fHb55LxWHUZqYcpo19Ulr1zV7DybFnhaMEFMkPL5G:fH/eUZqE3UltVnyhnhaM0PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623648657, "uuid": "1b3513dd-9565-486f-8815-02d2ee0b1628", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623648657, "uuid": "ed57db64-20e7-4587-8a9b-765c8db6efeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648657, "uuid": "ecc05a40-b68e-4f03-877a-782aa7020fc6", "value": "Ref. #20880 Purchase Order&Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609ec182-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623658828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658828, "uuid": "24edc705-d170-4576-83b6-63e6c0809725", "comment": "Malware payload (ArkeiStealer)", "value": "fb1ad08f652a40059277a4e995ea5b66", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658828, "uuid": "7e6176a9-5e2b-47b9-b477-e744b564ed2c", "comment": "Malware payload (ArkeiStealer)", "value": "739ea02b27b4ddb79ba40418fe09fbdd723b73ad8dabf5f2706f02e1248197dd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658828, "uuid": "ca401661-e679-449c-95ba-26aa59f19c49", "comment": "Malware payload (ArkeiStealer)", "value": "c7db0e9dfa1f4b4bf54820df1a5c8ab2cabf3042", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658828, "uuid": "9ff2b5f9-7c53-40e1-a59e-288509c3ea7c", "comment": "Malware payload (ArkeiStealer)", "value": "22313668b53c65622f7945ce8d5a30e1032127622a862ae26b3eecbf0ad007763c24877a58f64f58065b7099cce5fc70", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658828, "uuid": "a3fb0288-ef7f-488b-b67b-d4fa1c105a5c", "value": "EB552339A681867BD1120532484FD3B2B53BBA059B7C59CFB7DD0E6D8C372061AB42DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658828, "uuid": "7720805a-6525-4549-b3dc-bbac1368f39f", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658828, "uuid": "e42c3eeb-a68a-4b25-ae57-158ed4ceb338", "value": "24576:pAT8QE+ka/2i+llsSphe8VfD1Gk8tPh9o2Zc5KdekBOIaLiu6XCorYz:pAI+NYl5NhDWh9VZvYZqCore", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658828, "uuid": "c6663203-a748-4353-995c-96ae65b74626", "value": 1286300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658828, "uuid": "05f50f21-ede9-4525-beb8-9c04fedca2bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658828, "uuid": "68e736c9-2aa4-43fc-99f7-fe7082a846b7", "value": "fb1ad08f652a40059277a4e995ea5b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36b8ff1-cd32-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623690428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623690428, "uuid": "de37ee97-6243-4ea2-86c5-4c19c188407c", "comment": "Malware payload (Mirai)", "value": "fc5718b78b1fbf05bf02fdcf13c5f851", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623690428, "uuid": "7660de56-0b50-4b5b-8113-adb98c067f3c", "comment": "Malware payload (Mirai)", "value": "7422da38a9c543c3d5aa22a481e349bd7d2fd929655fd9814eee665f8d72e5d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623690428, "uuid": "63bc6aaa-7483-4e9e-ba64-71e17f0cac74", "comment": "Malware payload (Mirai)", "value": "817b53557aa62ae96961d9810cbc71b1df5e2691", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623690428, "uuid": "00106b97-b9b3-47eb-bc35-16d1d7155581", "comment": "Malware payload (Mirai)", "value": "2844c632a69c686d6f7cda9f1f2f78bca3c3c0dcb21d83bcc399e0eeeb8d135ed656c76cbb373a1c22e53f3c520d5b96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623690428, "uuid": "ca2f5fad-a392-43ab-9da7-b0521823a00d", "value": "8493F886B8918A11C9D423FAFA2E118D332253F8D2DFB252DD145F7437CA92B0E7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623690428, "uuid": "402b2d9d-f6ca-46c3-ae3e-aae7c6e24030", "value": "1536:1ynCyYQZ7/AQAQ4RQEix4xDaczKr7H58ghV6S43fSnr8oO0b5N/l5OZHcxI8iPbs:1yNhAhRNy40czKnH/VO3Knr8oOQlIb1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623690428, "uuid": "825daaba-835e-4be1-8d18-013c8904013c", "value": 91812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623690428, "uuid": "218087db-057b-4e19-97aa-70018e19554e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623690428, "uuid": "89748357-426d-4d7d-b3a8-ebaea3aebdfe", "value": "fc5718b78b1fbf05bf02fdcf13c5f851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1047c0-cd09-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623672699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672699, "uuid": "77318864-6fb3-412f-bf58-ae4bbf572db7", "comment": "Malware payload (Formbook)", "value": "493ce8d5c19d17e66ffc243d7df08347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672699, "uuid": "1fe5f25b-7295-4276-a4bb-cac3eecbc6e6", "comment": "Malware payload (Formbook)", "value": "74743d6468cedf3e66f1171ef32981dca4fb211b3fd7be519045fc42b077ced2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672699, "uuid": "aefafdc6-bb18-4108-8980-05a1ec664575", "comment": "Malware payload (Formbook)", "value": "b08929ddce098caff520deba7219e4d8ebac6511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672699, "uuid": "eb16720a-620a-4c63-a317-a68d8c902e64", "comment": "Malware payload (Formbook)", "value": "05689c689968f19aee115148b39dfed89fcca70dd8db3cad7e5c566ed04a5f9b9076e3701dde923bafd7d7ce99951375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672699, "uuid": "099440b1-2862-4a09-8522-e97bf9f9685a", "value": "3B34125917D4A0B7F59249B017B7EFABEBFF7B04B0150A0327A00F9F7C04293065A6A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672699, "uuid": "d3786452-73cd-4934-ab8f-623ce6ebe28b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672699, "uuid": "6416a58f-2c02-41ea-b3a7-f20e40fcb002", "value": "6144:Ds9Kooyvj4qkJ0hDuZHnO5mozUO/rpWWbRtfQiTdD7Hz7awL58D:yZoyvjLEuB5VjbRtYiJKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623672699, "uuid": "a4f9a3ed-d810-4d90-b0ed-f06dd96bfa62", "value": 245894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623672699, "uuid": "fa995d56-8451-425b-b4aa-7616b802e68e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672699, "uuid": "f6d26f3c-f089-484b-a3f3-e45c12daf68d", "value": "NEW ORDER7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11832a6b-cced-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623660413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660413, "uuid": "a8c6d4fe-f7e8-4168-8486-084b07e54e9b", "comment": "Malware payload (AgentTesla)", "value": "2251458bc8bebb6e24ad0b38714d32f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660413, "uuid": "a89af70d-fa54-47fe-98b1-10d91b1c615b", "comment": "Malware payload (AgentTesla)", "value": "74d85fffa66636fd8c21cdd04617a4c39b8156ccb9dfc84b94c190c42b1baa83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660413, "uuid": "9c9a4f93-47c9-43eb-a6ac-beb615707b2c", "comment": "Malware payload (AgentTesla)", "value": "941108a8e316f43a88e55dfb2d25bcf58c6bbdcb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660413, "uuid": "1fef44a8-511e-47f7-b296-7fd0c6d25833", "comment": "Malware payload (AgentTesla)", "value": "961c970ae1cf817324a5bc53c2f3719c87cd3e3fd11f5140a425298aba3f5f623e8cea394b048bec246f65b880c2602e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660413, "uuid": "9bf59431-a972-4bfa-a898-2fa128b56947", "value": "419423328B14CE8B5C5CEF9C69C5540E78944A78D2B861BEF593B28F6D2B74D24F6803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660413, "uuid": "a164b700-4ba5-4816-ac65-ef04f94ca306", "value": "12288:MRps3btav+kBlPCdq0JfI4AD//2YI2DTNz:spEtqrBlqY52Yppz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623660413, "uuid": "511770c0-524b-4b40-9854-4784290c314e", "value": 437821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623660413, "uuid": "28bc03ba-30bb-4efa-b233-3833d7772d00", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660413, "uuid": "f5c6d2a5-35d3-4a36-9f23-3c81d3d54182", "value": "177RJNJNQ8033VFB BL60059611 HLCUTA12104FKNC0ZH210385 6006153160062575.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf55684-ccd5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623650499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650499, "uuid": "f1ba7361-eea8-4f75-a1e2-b961d74b1b86", "comment": "Malware payload", "value": "16f4eb5a921639c3776a67b26cc55ea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650499, "uuid": "5f0cca58-6a1b-439f-9b91-49a663c37f5f", "comment": "Malware payload", "value": "75d94a120b4f0d402b2a5209c34f0e61612bd62fa77378e7cf0ea88362bfeb75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650499, "uuid": "9bc59a89-4f6e-4044-befd-110db0623859", "comment": "Malware payload", "value": "6c5160f2418eebbe3b6937f853ac3b08c31f6d08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650499, "uuid": "272710c2-6c2c-4797-af0d-5c9fafd62e72", "comment": "Malware payload", "value": "7468cb1d6c19ca21f39577dbeb86494e34f278b768c614fcaa12e356135fc29e06776eb5f653b629c1e5dfd7ac25d293", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650499, "uuid": "8bfe3d6c-a8c6-4831-802c-b7cc00d7e591", "value": "D825CEA4E3540A45E0BE637A4A318044ABF6FD26CB35D75C7CA971E90FB27818237E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650499, "uuid": "48bfee83-3a1d-4950-83fc-8eaff79c892e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650499, "uuid": "3f1d9487-89bb-4517-be54-1a81e76ff754", "value": "12288:jSVLH7mlZM4e/ZUdtbNzARId/uBZ3byhxeXoh6uoK45ql+4/sD8/kzDv9u:jCbWNeBUdtSIGereJz5ql68/kzD1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650499, "uuid": "59e52dbf-aefa-45a6-975b-21766546e0b4", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650499, "uuid": "539b5a8e-6c02-4f70-a137-d5267b8e02e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650499, "uuid": "87fb5423-0344-450d-a3fa-e02143af4d55", "value": "Payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bee8224-cce7-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1623658042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658042, "uuid": "ca180173-e3c4-437b-a01b-90fef548a54f", "comment": "Malware payload (Adwind)", "value": "044ebc1e227be0f2f49d8f8aa11d2780", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658042, "uuid": "6d86fdd3-b883-4219-aca3-92716357b800", "comment": "Malware payload (Adwind)", "value": "76299cf99d4df972c4667d1ee42fdc21e20ba6a7060aba5940433a3419d89b97", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658042, "uuid": "57f87d04-b17c-4bb7-80f8-7ae2d03320fe", "comment": "Malware payload (Adwind)", "value": "836185994a4167cf2bb9f08ffdc0c2f38fd89b06", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658042, "uuid": "3a365638-93db-47ef-80dc-15cb401165b0", "comment": "Malware payload (Adwind)", "value": "bc68485e80371928f450300b14ceb3b6b5f803df734ca1d5c9348201f4f3d55edfbbb456277eb06f3ad7f687f0387ba1", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658042, "uuid": "c18f2412-38bb-4530-b896-c8fd2fdd313f", "value": "9BE4333AFA620F308D397D143FED666C2D9980123B5AFC47E1DB0590AB07B981A89DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658042, "uuid": "9a6b4bce-4c01-4eab-a16f-9f43c2bd1c6c", "value": "12288:QJG82BsPPaFhzkWjhAfrbQcbc1z1mUCUO0NJzRferwYYCFVrLfFO8yUxIX0cny0:nEXaFh1+zjI1zARCP99/orM8yUxTcny0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658042, "uuid": "c8714c20-cb86-4ae2-875b-3007c018aa80", "value": 660996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658042, "uuid": "7d55168f-4efa-4624-9830-32b4c2cd80b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658042, "uuid": "dcdf089f-4492-4f6a-a5ac-cabee4041052", "value": "fac.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a606f4eb-cd06-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623671400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671400, "uuid": "a810bce0-b937-41a9-91c0-f98262f6bf01", "comment": "Malware payload (njrat)", "value": "e934d5c333d242150b5eb1051614e3b0", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671400, "uuid": "c2c26703-1ba4-4795-859e-081f49b3093f", "comment": "Malware payload (njrat)", "value": "76cbeb5b8abc214c03e4131402d9968af6131f24d18bcc02c1aa9b68e8c86266", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671400, "uuid": "60ed1de4-119c-493d-af3d-05f4e2e7a720", "comment": "Malware payload (njrat)", "value": "31b9e910586518ec70ad9bc6b2ccda7c2d36f006", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671400, "uuid": "f9d24e13-2dbf-4ca3-a0da-e90fee3f5993", "comment": "Malware payload (njrat)", "value": "1cd2dafe56a1f0d1a5dbd59d4df49167794865f13f0394a6c5019327ba5999b50060505a781b31091effcbf9c36bb5e0", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671400, "uuid": "4bd342c6-3b53-4172-9762-92762f06b6d3", "value": "10352357FDC0D788EC9744F4846BEB481158DC403EA5D91F016AB6A7AA34332B0F6B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671400, "uuid": "e3a4e554-3558-4246-896f-ee12bbe172f6", "value": "24576:76nQqR8su61dNJlcoQWquRsRzSnBGIm7iUzVrk:7M11drlcoqdxSnBGIciqZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671400, "uuid": "eca91402-538f-431e-9f23-e63138b41a40", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671400, "uuid": "eb87f20a-d4b3-46cd-85e1-9565de4ca097", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671400, "uuid": "fb01ec23-fb49-418f-955f-c14b3097ed65", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de58eca7-ccf1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623662475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662475, "uuid": "098ea303-3459-4212-a662-81cfd4c762e0", "comment": "Malware payload", "value": "aafbe6a8474a197997f1695d95f234c6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662475, "uuid": "df1c264c-de23-4c00-8eb5-e6912c118474", "comment": "Malware payload", "value": "782160b64f3fb9e5fcdba0e21870133996daffa17b9c7cb3ba9d85631c23c0a9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662475, "uuid": "6c9c6ef9-315a-439c-afc4-a7cec6e638f1", "comment": "Malware payload", "value": "0a80c798cb463914fc93f662bbeb0015eb44bf95", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623662475, "uuid": "2509eee7-8acb-4f59-a292-032e909232c8", "comment": "Malware payload", "value": "e47109a07ca13a92d81477abf5d08864635fedd0110cd9425823156ed036b7346b61f9a3e14d2fdca6572443040fd39e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662475, "uuid": "30769ed6-6698-4c31-9e3a-b73b95fa0438", "value": "9C458E9C31E6A152C78B64F0147FB42EF1BDB8AE10DD05878C93E5DE6C5895AD322E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662475, "uuid": "8b724077-5ee9-40f2-96b6-32177f4e534a", "value": "1536:4FFlXNF7IFXxUUUUUUUUULUUUuUdLNxBrt14OUdoQHFraQdLNxBrt14OUUUBUEU7:4FFlkFFlYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623662475, "uuid": "7d3da03f-5a5a-44c9-98ea-394df9584258", "value": 1221980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623662475, "uuid": "05cd6de6-7f3c-49ce-b1df-9e98d27538bc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623662475, "uuid": "128c686c-bd1f-4a19-9ff0-8b34a243e8f1", "value": "RFQ-NPO#298100.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdedb75-ccfc-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623667090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667090, "uuid": "84592917-ee41-4cd3-9c83-fe3dcbefb009", "comment": "Malware payload (AZORult)", "value": "3e646eddd026c47e0c97cb722b3c4511", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667090, "uuid": "a5e862f5-fe3b-458b-8008-e5ae4b17a8e8", "comment": "Malware payload (AZORult)", "value": "78bd1cbbc018f664872ce7967306f25e22d9f6cfeff65c3716e82b2866949387", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667090, "uuid": "5e408ce1-a4d0-4125-a2f3-6022e512e998", "comment": "Malware payload (AZORult)", "value": "8914947370cd6c469dc0263f24ee086d5824c9b5", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667090, "uuid": "43d93f0b-3d82-4420-95ff-ededaf1de24e", "comment": "Malware payload (AZORult)", "value": "31c6a2b283b9a72f9965ee64352295fe333399e07afae42136aff36bd963584aaa65b272ea5bc70dccc2eab701e3f2a0", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667090, "uuid": "08c55c56-5c86-490c-a53e-5d96cd340124", "value": "C4E3025A72C5C977E1E74A726A114BBBD772BB0637201A5B3B305FEE05332C26D221D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667090, "uuid": "cecf2b1c-8914-47d6-9b56-c7c3792a36a0", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667090, "uuid": "8b73962a-102c-40fb-8b81-ebb67ae2bb5c", "value": "3072:DQIURTXJ+MlbgnTG6ajsRU7jiYGknzgFIxWq92DjlPV:Ds9l6DdhYGkzgF9Nf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667090, "uuid": "076225eb-f29b-4b3b-b825-df1eeb1714b2", "value": 151051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667090, "uuid": "2b5c3fe3-67c0-473a-990d-7f4c46110c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667090, "uuid": "da488c75-b1f8-4a7e-8000-ea3a0c7b1bf2", "value": "4 Pallet Shipping Docs.Commercial Invoice. Packing List. Bill of LandingTHS0094587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9358d8-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658903, "uuid": "35c83ed2-c6b3-42e6-8eed-e4cd000eca07", "comment": "Malware payload", "value": "fef84dc871b1b4da3ce6cf0614903e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658903, "uuid": "b5fbaafd-ab6b-412f-ae7d-2e37c6978599", "comment": "Malware payload", "value": "79e07f3224ce5b3479c4f8573db824dbe69eed10f034ad2d0f96359b250556e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658903, "uuid": "b4543be1-778f-40a7-92fa-67d2f78ca7c7", "comment": "Malware payload", "value": "2c3f6c7c8cb147efaded79d0cfb7d3fb9f2a1a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658903, "uuid": "4f5412a3-b336-416d-94e7-57029a4598f3", "comment": "Malware payload", "value": "f2bdf6f51d6ffec68be21a0001b29fcfbd58afa33e75c98abb4a11f8e9513e9c4e49c6175a5d976086479335f859f14a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658903, "uuid": "abd2eff4-72b4-4050-8040-9f717a269555", "value": "86050200B790C0B0F0F712F9467B9EA9A6BA7970AB6554CF62C456EE1774BE0AC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658903, "uuid": "5f039633-71ea-4b92-b0e3-97922589f806", "value": "6cd3624424046da1202929e6b9b314ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658903, "uuid": "a8c68fa5-4479-4c16-9dca-461e7b873bc8", "value": "12288:D567EoqvGJvp28m8pvropjYYFQwEj4tBNmZO2lM9AMTsSa+uSgsz:D5qqvuxcpkYw6V1Ts0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658903, "uuid": "8a23046c-fa2f-4865-a13c-3519a3a98b2c", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658903, "uuid": "50de682f-a426-488a-b65a-297ca20d4aaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658903, "uuid": "f88bb8ba-29a4-4075-8e32-cb4bf21b6e09", "value": "fef84dc871b1b4da3ce6cf0614903e81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2789856-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623652147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652147, "uuid": "08aa1370-934b-481a-b551-6bf82382342e", "comment": "Malware payload (AgentTesla)", "value": "4de77e3206ed554947b05152fbeea87c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652147, "uuid": "c5dc21f0-251a-4844-8fd5-79c6c669f267", "comment": "Malware payload (AgentTesla)", "value": "7aa68607125bef983ddab226fba6d49d5ad2fb35348d981b33a2dc469ab045ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652147, "uuid": "7c3b5037-1cfc-4aa1-a36e-e8a4c85ffdc6", "comment": "Malware payload (AgentTesla)", "value": "5ed3f6530dd9c0eb594edb69ad86289ffbd275c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652147, "uuid": "6bc13a61-d255-4d1f-b7d8-f76a62dae6c9", "comment": "Malware payload (AgentTesla)", "value": "02bc1a1b7b56fda4e00ea99c271b6b32c7a8229e2dd81f4fc010d0dd091407a761e09bd3776ce484330d170554af89c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652147, "uuid": "ccb34671-704f-4275-bc02-093486304889", "value": "0BF4121223D8AF67D23E55B01461609106F2EC26BB31F6DA7E8C75DE39F2F848741B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652147, "uuid": "2161a91f-34a0-45ab-ad66-360fc9c03400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652147, "uuid": "517dcd5b-cdad-48a0-94e4-b72e73ff1272", "value": "12288:b37ZRUVYtXiZbY9w3m4fBriuE+z59XB8oz5kNnl0s6kYrH3kN5B16LutMViJRI/l:5RUVYtXiZOx4B8ASNnuj0N5B1QUYiJRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652147, "uuid": "ffae7df1-e763-459b-9c04-7b833ce72d7c", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652147, "uuid": "cdfbfb73-c4a4-4a84-8172-50c6a7a347e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652147, "uuid": "b3e0d75f-4995-4bb5-b64d-83ed71d44e66", "value": "Hesap Cuzdani 08.06.2021_Nolu Hesab\u0131n\u0131z\u0131n 0198010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3b735b-cce0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623654823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654823, "uuid": "d50876d7-08b6-40a4-8036-c06347983115", "comment": "Malware payload (SnakeKeylogger)", "value": "a0ae40b0b52ac913873d94849077dfe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654823, "uuid": "8de49695-636a-44f7-b9f0-89f30b22dc53", "comment": "Malware payload (SnakeKeylogger)", "value": "7aba923c5f120f7a1f2c2eca4c7357615cdcf5ca472d53d27bb541999b04f436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654823, "uuid": "98e6d3e2-f388-48a3-99c6-576412ed185d", "comment": "Malware payload (SnakeKeylogger)", "value": "2a6e349cd182c8a2b1b77d8475b5e52846301434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654823, "uuid": "8bdec42b-c3db-48d5-afb3-9c31bcc5b2b3", "comment": "Malware payload (SnakeKeylogger)", "value": "11b4eb11e1492f71cf0c6d83a20883d0306e2c63ef1e08fd7280bbb8fd8bbef5f1e2eda7af70f2298d16b325d48d7480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654823, "uuid": "41e4de9b-b63b-45dd-bf20-09e081edf968", "value": "59E5A16464DAA48EB53753D20AD0A6D2DEEAFDF0713DE1A34628072FC6898057CF4379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654823, "uuid": "2c3028c1-d5f0-47c1-90a4-fc6922d6b648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654823, "uuid": "b10c7819-438b-4391-aec7-90d10d8faeb7", "value": "1536:8GKeSkSgXYr5epbTaphCIzmlTHdTGnTMvnEIQXTQv5qFk8y3K/jLniW3/HWmQgum:8uSk/XYuPMYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654823, "uuid": "8e39db1f-442c-4e78-a3ec-0213b5a3dd0e", "value": 3212800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654823, "uuid": "664a20d9-33f0-4376-aec8-cab471e623c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654823, "uuid": "73f86576-ef95-40eb-94d8-f8b61c632161", "value": "Consignment Document PL&BL Draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445a04bf-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623658781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658781, "uuid": "4e6bcbd1-5787-4d32-af76-ef54023174af", "comment": "Malware payload (Loki)", "value": "253a9d73c44cda01c20b6af9b7c66ece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658781, "uuid": "b042142e-1a6f-49fb-99e7-a634012d90ce", "comment": "Malware payload (Loki)", "value": "7bf46725592524d06f2c62378872a34b0de33def00f43cbb1a33b65b963e527e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658781, "uuid": "82d8b4e7-99f7-4f45-9907-97eeacf60a15", "comment": "Malware payload (Loki)", "value": "522434f59a8079cd2f8df486864fe5d869e52892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658781, "uuid": "67e3a753-172f-4e54-898b-a0d82d88895d", "comment": "Malware payload (Loki)", "value": "42b42bc8de13873a53ea3cead580b30f87a6f3a1079978c9d15ba7b38096a90350d8edeea3973996257143142b5cd732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658781, "uuid": "65a1a930-3de9-4bbb-9769-31e4b32b6e45", "value": "EC05E02236C82BA4D5BE6B394672150083F7B917E736D60D7FAD609D1B23F41CAB2B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658781, "uuid": "c1f48a60-c5c4-4206-8981-e7bba37acf2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658781, "uuid": "7cba4f81-a19b-4f50-ae9a-5eae0840e08b", "value": "12288:Fmzh3sYy88hRUSXgONwBgN+0bTg31ISMmS5V30DTOyxlZM4e/ZUdtb:FmiYyT41Bo+0ftLDV3ITlxlNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658781, "uuid": "9572bed6-7e1a-481b-a346-7f26a34da43a", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658781, "uuid": "68b139e4-8324-4453-ac7e-241b901b3194", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658781, "uuid": "7dfe4dea-ca01-4490-8b1b-f4d5571b5874", "value": "253a9d73c44cda01c20b6af9b7c66ece.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157913c6-ccdb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623652689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652689, "uuid": "b997358d-579a-4745-9291-30b986bc8326", "comment": "Malware payload (AgentTesla)", "value": "ff658c2bc4b42bedb3b7f2c8b51e2376", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652689, "uuid": "a6b509ec-16ff-4cdf-a896-479043bffa0a", "comment": "Malware payload (AgentTesla)", "value": "7d45975535901f4a1ca0e344cca8a844e15fcba3af40d55e283966bc148a8b53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652689, "uuid": "0dc68ee0-7ed1-4a94-87e5-fe71fbca807b", "comment": "Malware payload (AgentTesla)", "value": "5be0a1993a5273ce78455ecad4055761515558dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652689, "uuid": "9117b221-aead-4364-a1e3-65c6f1e428c9", "comment": "Malware payload (AgentTesla)", "value": "fbabd9a4be4cbfd4150a160015bf1cf91bbb21b5d137579c2fac4629dafed29d999b1106da7cf27deea66220e484efa5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652689, "uuid": "7c927acd-1424-4b8f-9df6-903c604e3164", "value": "89158B3D17441FEFE17D16B87029150DAEFB93932A15EAAD3CE540CB12C1F03A76169A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652689, "uuid": "6ea44fca-ca92-4c3b-81b7-e63eb0a1102e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652689, "uuid": "e8979309-ce15-476d-89c4-855c2b974e31", "value": "24576:Fw3Hx9MASUVYtXiZLtEHgHqngi/TQkTaCtC:wSUYtXiZLtEVn/82C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652689, "uuid": "20225d98-3b04-4187-9af1-27a0e8c5a69f", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652689, "uuid": "16ce2bb8-52b4-4f66-8179-39c9ac795d2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652689, "uuid": "aa6ff852-c901-4bf3-a15a-5732975c49a5", "value": "Sepa transfer advice notice Swift EUR89570 20210606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862daa91-ccc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623643859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643859, "uuid": "d61316ca-a8d5-4434-a7bc-c4d8f2b52ce8", "comment": "Malware payload (Loki)", "value": "636287087bb5e41dd0df487c2efa5850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643859, "uuid": "9762f17d-2104-4d54-9398-243bd5e25ad0", "comment": "Malware payload (Loki)", "value": "7d536f149a8e5dc760bf8d09a7b28a477061fbde6883c49effdfca27b298ddca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643859, "uuid": "21dd7bd5-7d8b-4d05-9ce2-b35b7fe80e23", "comment": "Malware payload (Loki)", "value": "f19f246321d0a74f8cf5a1224b5a0eccb86305f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643859, "uuid": "72c2128b-677d-496f-83f9-35980d2d555a", "comment": "Malware payload (Loki)", "value": "1fbde3c8f4a815ee054065f60400bbc89573c260c756db6c53a04470d5c5a5816440c94cb390934a0aab9be40f520edc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643859, "uuid": "adf35fb5-96d4-4243-96da-bfee68677262", "value": "C735C022B255C96AD03D89354472D1EC02F1EE8E6B28E74B3DD07E6F6D72384D972B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643859, "uuid": "e9061700-e04c-4371-bd32-ba7f0b19ad2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643859, "uuid": "2e54c9e2-ea7e-4b56-9d42-8acb72d979fc", "value": "12288:MUBx6+jNe9fEVbWtasGO0ALEym7dm1TRQsxMkPsmh9VCZ6vP:tBxNjNel8bWtLGO0Cpi0NRQsxMkPLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623643859, "uuid": "5cdd72ce-e36f-43d6-b172-1bc5dfd303b9", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623643859, "uuid": "3e726e5b-f5dd-407d-9ad4-9b362ec9d79e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643859, "uuid": "5ff5ed9a-4600-4988-a119-093ab61d3f50", "value": "QUOTE 1B001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec7197e-cd06-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623671441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671441, "uuid": "1abb3e93-d691-41e8-bdb4-23384dccd15c", "comment": "Malware payload", "value": "b2195f0bcacb996c1ab33e9a61fa51c0", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671441, "uuid": "081066b7-01da-4639-92b1-f94c08477dbd", "comment": "Malware payload", "value": "7e4d0f230ee4c455559aab72c90e47be45e1c82f83869515a72dcc5313d2c28a", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671441, "uuid": "ec90eaf9-e005-4933-817a-29b347b85712", "comment": "Malware payload", "value": "0dc080356fd53c168c596c9ccd7515e66cb0acd2", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671441, "uuid": "9cb7d28a-1dd3-4e3a-be91-1a9caef94281", "comment": "Malware payload", "value": "d18e015afb61e3f474c2a395cdbeb432ebd3f0eb637737715d592925a52f44af16cb6037da0858d3786c2cde43c0083c", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671441, "uuid": "2e38263f-9922-4c97-a56d-187b2c0e236f", "value": "FE45232CF8C21B03DDAB15B8084C6F2D80375D66A762AA265F557BDE303A73D8587738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671441, "uuid": "80e0fb46-4703-4b8b-8301-fa3b109825b2", "value": "24576:rXeLUVTSS0swyRLefeWWTk4FXv11FT4//rETK78gp+Q2gVvqB3oXHl:D1VTSiLe2WWIW7l4/zqK3Vv0YV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671441, "uuid": "c51b620a-ec42-4505-9230-91c8f576c626", "value": 1231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671441, "uuid": "a1f10bfa-2f8d-4d99-adbd-3ce05e5a7f82", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671441, "uuid": "31b65039-0c58-4f9e-a810-b0c258be2ba9", "value": "\u03b1\u03bd\u03c4\u03af\u03b3\u03c1\u03b1\u03c6\u03bf \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae\u03c2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28d95e1-cd0d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623674401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674401, "uuid": "669fdf33-4fb5-4cb1-aa1c-5efeea56dfcb", "comment": "Malware payload (Formbook)", "value": "285cc0e41ca87f5eb2a6d08680a0f94b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674401, "uuid": "1a2e2e75-da25-4335-a358-cf87458adb1b", "comment": "Malware payload (Formbook)", "value": "7fe8fc25255d0fbe221579b985327bb67bb1226f39dfc71b8b59e6a2b15fff11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674401, "uuid": "380e712a-49dd-4b0f-a21e-c8906c7c6a32", "comment": "Malware payload (Formbook)", "value": "cb194a9597068cf2614a25e5df9881cb22fdbed6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674401, "uuid": "77250f5a-72b8-457e-89b8-e6309f0c2676", "comment": "Malware payload (Formbook)", "value": "826fb0bb113c15e7ef3186ff56b0550d0f2f075557c5694d0f91f24a06e9a42c04d42e4c71f6d3c64afd111123630fa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674401, "uuid": "8daa120a-ca4f-4e9d-9d1e-e02c388682c6", "value": "5305E02523D88B45E97E4738D265018093F1F82BE325EFDDBD9944DD0EA4F808366B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674401, "uuid": "cb38c7be-2e11-4656-9815-8c7b2903a6b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674401, "uuid": "5017cfaa-b4de-4590-88b1-14dd5d4c9ff3", "value": "12288:I9pjeQ1aTLMc3TdK8LmgI/RfAQiq1X1cqJ5cEuK6jIbHSGhXH9VCZ6v:I2QETLMKTdcgKfbJX15u/XGhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623674401, "uuid": "d113b887-1c49-476d-a01c-b0d6a017574f", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623674401, "uuid": "fff7fac7-8e84-48a6-9779-1fe0f784500f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674401, "uuid": "17fc142b-9fb2-4416-8036-54777d1d0749", "value": "285cc0e41ca87f5eb2a6d08680a0f94b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28391d56-cced-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623660451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660451, "uuid": "7f177880-aeca-4438-bee1-f4320320ae16", "comment": "Malware payload (AgentTesla)", "value": "c55effccb011e0f558c944f776c4bf95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660451, "uuid": "082a4e4c-3813-4e34-a55b-373cd4a406e1", "comment": "Malware payload (AgentTesla)", "value": "80578b53df5cf0213e777d65123f8afc7b779cfd412b8df2f690a6947ea082dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660451, "uuid": "0d1f2f65-05de-4272-aa79-199d54aa469a", "comment": "Malware payload (AgentTesla)", "value": "b47086a3e930ebef6b834a3f43d625e168449b3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660451, "uuid": "4eb5c174-fb08-4ffe-a9e8-6702ccfcfc5b", "comment": "Malware payload (AgentTesla)", "value": "5a80e2be75d97b36bcbec5984f5934082b8fa38ab9786d9288ee50014a374cfc1c4554027686663fd510c5fe8984059e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660451, "uuid": "05ac1583-ed9a-4768-a94c-029879317df6", "value": "81A402003ADAE01AE1365FBF9DE53781AA7EF9666A02E54E34C1134E0A13FC4DD1163B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660451, "uuid": "b6f073ee-895f-4aa7-9fb6-200e62b74253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660451, "uuid": "8e44496d-3ab3-4c9f-ad9c-57f1107729c2", "value": "12288:N4WXcDPZJCQf2X87NqJxQX+0nTwxiUjDyja3m:N4nDx5ewXvTWPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623660451, "uuid": "4f2d3ac0-b909-4517-9133-86046c0b452c", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623660451, "uuid": "18be2c27-ddb8-4397-8bd0-3a9a97cc15db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660451, "uuid": "bb677d9f-6316-4f18-9146-04d2dae3efc1", "value": "177RJNJNQ8033VFB BL60059611 HLCUTA12104FKNC0ZH210385 6006153160062575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574a2c51-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623652370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652370, "uuid": "0ff1c78f-ab0b-40ee-862d-dc21b506bc03", "comment": "Malware payload (Gafgyt)", "value": "aedd3285d8437cff09a41fd9b4bda5af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652370, "uuid": "3196ae64-cac9-4c40-a6ae-e54b5b46e726", "comment": "Malware payload (Gafgyt)", "value": "80d8cc36b0edbd702cc07507f2e0a5197d8fbdb635fff0db16849871ed5a5513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652370, "uuid": "c76dd111-57f2-48ec-a8d0-95b77160232d", "comment": "Malware payload (Gafgyt)", "value": "2c25444ed5e3c8cba054ebf662f6204909197d5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652370, "uuid": "93106382-f66f-420c-b07e-b512303d612b", "comment": "Malware payload (Gafgyt)", "value": "776eaf5c3bff6730dd74ba1b49d025ff37fad34cb2785fdf0b0dc8240bed046b9a09bccd3c33de3f4b8a240ce2ecc11b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652370, "uuid": "0ec4d677-6a17-4331-9b66-e3821c13218e", "value": "CCB33A0798615F77C045ADB529BB5530072BBA120F4F1F9AB57CAAB4074F8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652370, "uuid": "3fda967e-1de3-4ae3-817f-5033ccff6a1b", "value": "3072:moNToIWzKoFIon14z5hLwDecr68LkY0Px9gQNfR:TNUz2Ej4z5hLwDecrfLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652370, "uuid": "6e288786-8f3f-42d7-a404-2946b185b77d", "value": 108419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652370, "uuid": "076c9ccf-f765-4d06-9abb-f1ff0e47eae3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652370, "uuid": "8d0f2a84-2faf-4d1b-9fe0-71f70d86fddc", "value": "aedd3285d8437cff09a41fd9b4bda5af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b33b86d-ccd5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623650122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650122, "uuid": "2dc24fca-fa89-4560-884f-eafc0049c460", "comment": "Malware payload", "value": "41ce8db93e9d418192439669dfdcd459", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650122, "uuid": "fb60890c-c1d3-40ff-93c9-1bb75b1e7d58", "comment": "Malware payload", "value": "80ec87e06cdd29beb7ba70d2683738c5b06ed0f335173ff738ba15cc743a0555", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650122, "uuid": "df565140-3bfb-450b-81e6-38f3985776b8", "comment": "Malware payload", "value": "745ed31c10aa5067065751f5d834e3a7760f3c0e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650122, "uuid": "9ac964b3-6399-437e-8497-3c723ef6d3c3", "comment": "Malware payload", "value": "b0dfd8c7b875cae7e81b04528f467ce011ce7f1037be6f13d18e906f5c8391c7ba67386618d1ea1ebeed4d34bbab6f27", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650122, "uuid": "852d2de5-a688-4c9c-baea-0500c87aa1fb", "value": "93E42338EE1F18AFDD2E20F3165267E1CF7DB9755E61814848F33F7ADDA1286812444A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650122, "uuid": "776fdcd1-d54b-4939-af53-75b2d972ad79", "value": "12288:ckEMtJKlLb6SpLgmUaCK023oyPtJ/FTic1Dio8gBlVUD+OhZ2hgMghYh1GGqg:ckEMipb6YgmUBKrDLdGcdioLBlVF428U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650122, "uuid": "b1f68d4e-f159-49ad-a413-2ae2a35fb59f", "value": 665348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650122, "uuid": "ff3860ee-1ab5-4b3f-a49d-c0d72ecd282c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650122, "uuid": "8a8b7784-d948-4bc1-9e4f-f20099ac5d11", "value": "Halkbank_Ekstre_20210206_080203_744632.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beaaab59-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652114, "uuid": "8cfcd77f-872b-458c-a819-ca3e9cdfc280", "comment": "Malware payload (Mirai)", "value": "6fa51d2628c8484ab622393a8338f666", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652114, "uuid": "b6dff8f1-70b8-420f-8d16-a4a92579319e", "comment": "Malware payload (Mirai)", "value": "817136cf1e27573c359802eacc3b328db7c07ac46367485aa5c141f5111281fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652114, "uuid": "cb0af609-b1e2-4a8c-a245-15b15cbf49f7", "comment": "Malware payload (Mirai)", "value": "91fdba9f27174b711e93008de8bcfb8b0509e13a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652114, "uuid": "5d8e5e38-6856-4d9e-bf46-0f973f5413a9", "comment": "Malware payload (Mirai)", "value": "d614a036da2f40f921f09de632886a4d0c76e69b3017d040d5e518610bc15383aae44065077c39efe8233b608bf3f7f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652114, "uuid": "d58b9f97-1cb3-4ee7-9edb-4fde3090e5e7", "value": "7B04F704EA50872BC2D377BEFB5D028E37391FA4B7EB361159343A7427E5B64263A160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652114, "uuid": "26d6fa00-afaf-4818-bc46-17fefae4934f", "value": "3072:/et4bR9TvmRzVl9wW7h7vKE95jEv3LpRd7mRXvaQA/dRiLWkK:/KBRzzSWdvKwjEv3JmRXvaQA/dRiLWkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652114, "uuid": "cb80a366-db90-4fdb-8ce1-6d6377a962fb", "value": 188654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652114, "uuid": "24d6058d-56bd-4866-bd08-6e0dfef84d07", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652114, "uuid": "0cc0b1dd-4109-40c8-80ef-dfc8b2a0b139", "value": "6fa51d2628c8484ab622393a8338f666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc9a8f0-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1623650582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650582, "uuid": "9e2495b2-9b34-4efc-9c29-54fff40f2b93", "comment": "Malware payload (Adwind)", "value": "c29d959490ceeba42ab970d145f52954", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650582, "uuid": "ff3a0e09-503e-4304-976d-77fe91809196", "comment": "Malware payload (Adwind)", "value": "81f496ce09537b213e9425943def2e819fde1edef785424e7411723fe4a4c2b6", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650582, "uuid": "2f933b54-eaab-471b-be65-384b3155af8d", "comment": "Malware payload (Adwind)", "value": "e695911b8c2781e73b83286e24198cff8314d8bd", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650582, "uuid": "87ac1033-0e9f-4295-899d-94a831269d2e", "comment": "Malware payload (Adwind)", "value": "c7fb87556fd94ac0de5184bd0d50f4563d3875023848bf14fb92be22847983ae74812b841a9f079db078bce5324d03b4", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650582, "uuid": "511f3498-3c55-4400-a853-f25c2cb4692d", "value": "F1642340E3CA7C17CA8BA5BC97C2079A9BC711C2A4B266DB4077E7DE7A94D00F481F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650582, "uuid": "db14cf45-262f-412d-b55c-0c2bb6a8d9a8", "value": "6144:kxbt05/CeG/5elgr8a0ii9vgALHiq7Z9vhR5i6VNHah/YU6jr4oNV/iB:kVt0ZC75elgr5EtLiqdP7i6VOwU6jrpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650582, "uuid": "083fda52-1912-4d5c-bfae-236439ca3783", "value": 329972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650582, "uuid": "58af85f8-3fb6-40ae-9b7f-8d94fa599f54", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650582, "uuid": "1ea0517b-0d61-49f7-bbe7-48d505185d8b", "value": "09.06.2021_SIPARIS_LISTESI4.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc6a3cf-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623647386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647386, "uuid": "c43357ba-bb1d-4678-8111-880bba75f764", "comment": "Malware payload", "value": "4dfd0caa1bba34d41e02ac53f8d609b9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647386, "uuid": "e050eb53-9d09-4d9b-9778-964808ed87a6", "comment": "Malware payload", "value": "81fe8f7d3f171aa2065b541d1fca3ac861dcb905a87016f24ff40317f044127e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647386, "uuid": "a5ba464e-28f7-4fed-9c6a-c3d402ab20a6", "comment": "Malware payload", "value": "25905cbf4be967205821ee7aa1462afb0bbdc132", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647386, "uuid": "c25370d7-ec81-4568-a0a0-8987f1fc7c37", "comment": "Malware payload", "value": "b4e4dfb893302622bac2102a0c45c2f16718572c5b8b534507aaf4978bbcbb1de3856d0d49a153fa5cf9c2856f2a14ff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647386, "uuid": "d54e53a4-4e46-407f-83a8-54fddf4a0144", "value": "52227E3CC116FC1BC11155BCD14982B4FA2911A3F623B92D20A6339E4B911C79FCEE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647386, "uuid": "6a3b9fd6-686a-43d8-a3ad-a1244dcc05dc", "value": "192:ScIMmtPz73G/b1jt3Ojk0DiV/WBJKBv3w8p:SPXbuPOjkp80fww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647386, "uuid": "e9302f4a-636b-4595-8082-7f258ad9bfe8", "value": 10359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647386, "uuid": "b407080a-b517-4fbf-9dc8-985c76fa30bc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647386, "uuid": "7a2304af-65fa-43d4-b3d0-9778834b9b2b", "value": "payment5001.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacc9c70-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623652107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652107, "uuid": "888c84c2-283d-4efb-bd60-a7b3aa3158b8", "comment": "Malware payload (Gafgyt)", "value": "365c40ec4d50d5b4467d3b2a9e48d9d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652107, "uuid": "aa8525a5-dcf6-4469-aca9-4b6594a18482", "comment": "Malware payload (Gafgyt)", "value": "821386136432529b10eead3e8e8e0afe0baeebf6ffd652f52f1e8bdbdf3e370f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652107, "uuid": "5e16df02-5791-416f-b3b2-d14b2cd0f33e", "comment": "Malware payload (Gafgyt)", "value": "e529a8e5cffe35c6832c7d47afa9514753836926", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652107, "uuid": "8d22d507-8d40-4c42-9964-680d7b4e242a", "comment": "Malware payload (Gafgyt)", "value": "431078b5480ee1dd0d8bd4da43ed84243262796f51cae958d6dd1fcceac39f72e9f90cdac41e4d75c4412478d17bb20a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652107, "uuid": "2dc5b50c-4385-4f8e-9d43-7e1122689cff", "value": "7DC32A97F800DE66F40AEA3605D70735B630FB750E531A72A3573AA69E362E07827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652107, "uuid": "199b4cf8-c9b3-41c9-9fd2-31305b651d63", "value": "3072:+MT4bzt9BCw4MwTz/IOy+AvJ3sPcpe+3mvI0PDGnSQNER:+MT4hDCw4Mwfy+MJ3SO3mvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652107, "uuid": "33de06d1-f79a-4ef1-80fd-edd64edf6a00", "value": 118302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652107, "uuid": "c52bfd7d-471c-4a7c-8fc0-1daf896244cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652107, "uuid": "cef7f820-ae0e-4832-9f0b-fbd8f37dc1e7", "value": "365c40ec4d50d5b4467d3b2a9e48d9d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6e7e4c-ccd8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623651598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651598, "uuid": "e2c8ee25-fd94-4ed0-b10a-d483a2ab92a0", "comment": "Malware payload (Mirai)", "value": "300fa6566b7c3778243b9b44438ac1ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651598, "uuid": "61cae4cb-21af-4543-840c-0a619a53090e", "comment": "Malware payload (Mirai)", "value": "82eb8105e3654d9e469d12f192d12e1e141745b7a6e4e933adf951e4e98a5c7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651598, "uuid": "80939cb4-58ac-4bd5-9691-5f83aefd57b0", "comment": "Malware payload (Mirai)", "value": "04a4262e2586434096c3853b4b75c7b06911a071", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651598, "uuid": "46c9adf7-8049-4a81-85c4-62ad3e60059e", "comment": "Malware payload (Mirai)", "value": "c7f4712f3b95126b3538e1f8f82490bbc91bbfa1ab43ce82609a64bb11df5fcc8e12fbab69b012940a7376aad1c8e319", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651598, "uuid": "7e4b81e3-e8d4-45c7-b33e-4bd3fc5df7dc", "value": "2234523A3E31BB7EE2B886310BFA6E74C75524D233919251E17DE6185E7128C1C9FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651598, "uuid": "b4d536e4-d049-4516-830b-7b71185d3989", "value": "3072:7MzfW4303TUx1ko1yFLFTv25QZES0udD1m70zeaFswGQcYK:do0TogFxrHE4Jm70zeaFswGQcYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651598, "uuid": "57ab1899-0066-43f6-b6d4-0aaecad7008e", "value": 233924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651598, "uuid": "482e1f34-b09c-41d9-9b77-d77ca4e9a940", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651598, "uuid": "14bc36f4-d154-421c-8456-2254ac32f829", "value": "300fa6566b7c3778243b9b44438ac1ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad2e2a0-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652644, "uuid": "2ae53844-8777-4803-a7e4-29398608294d", "comment": "Malware payload (Mirai)", "value": "0d76dd00e568870c0b9c44c9cfb21de8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652644, "uuid": "036ae0e2-b37d-40db-b730-e469e96bf1e6", "comment": "Malware payload (Mirai)", "value": "831fcf5dde3450c7b61526006491feedc7c5322aafa213fc248e572598558b95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652644, "uuid": "a339b875-8a2d-4774-bcc8-ba008f4d7cf4", "comment": "Malware payload (Mirai)", "value": "adba06999077d6d284937473f0d7536e8044b59a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652644, "uuid": "743c4399-7787-4b7b-bb2c-61c926957ad9", "comment": "Malware payload (Mirai)", "value": "4e8cc334b2bd2590cb5641530916f7de31912b98a647d9e6572f28b2d9671811dbdbbc58c405c8c9739893b833dc2265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652644, "uuid": "3eb2ce9b-128d-47eb-8d9c-9e60034091ed", "value": "39F3194598A31EF7C012A979397B1B54071DBD621B1F5997293D7AA403AF0CFB00FEA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652644, "uuid": "f2e8db77-eb1e-4417-b8af-1d6caa9ca941", "value": "3072:9CNrgNIfBwAeVSCnWzOiT38RVuGquXem6tJPNl6Fnm4ncO07jaBdrK:9CNkNmBw1jQdmmV6Fnm4ncO07jaBdrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652644, "uuid": "dbb63a0b-db6f-4c2e-a08d-7f619c66e1d5", "value": 166737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652644, "uuid": "cc3a63f9-8779-41f6-b832-f0efc359a285", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652644, "uuid": "890e76cf-649d-4f64-8e62-9f02282c937e", "value": "0d76dd00e568870c0b9c44c9cfb21de8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed8f854-cd10-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623675656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623675656, "uuid": "f2aa8152-0200-4268-baf4-45cfcc9df8d2", "comment": "Malware payload (NanoCore)", "value": "92af81a6347cc6a87535f512f66dcb20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623675656, "uuid": "ce9ac4b8-4c2f-42c5-b766-9a9342ef8a94", "comment": "Malware payload (NanoCore)", "value": "83979cae4f4071c2d01ffd89962b4babf850639d70a14b6b3eb2e1ed0cd08066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623675656, "uuid": "b61e7bd8-cfb6-49a2-b412-3ad9a0219c87", "comment": "Malware payload (NanoCore)", "value": "5d8a400f1948077630fd908ebe0bbef4d00663d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623675656, "uuid": "d2ef7b07-f4fd-4d49-bdaf-367d4ed4a6bc", "comment": "Malware payload (NanoCore)", "value": "41c1f18b2032d1264d3b5b04874fa58315b0263268769cabeeb2cde8815835b26208d10be8d1826492bfe185f6aeb287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623675656, "uuid": "5348f462-d2ca-407e-8066-4e8627142c99", "value": "F43512206754AB62D13E87BD5461100163F0F21BE736CB5EBEF8D5D90B92B464AB63C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623675656, "uuid": "9a933bc7-32ff-4582-aa65-53e604f83bd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623675656, "uuid": "1a0ca89b-95f5-4f6b-8446-046e71d616e6", "value": "24576:kSMluNELuYA5O/iTW/chmTnehlX15aYGnIZ6onIg39nVC:kDluNLB57TWSmzeR1GJoIgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623675656, "uuid": "91b7fe0e-ba31-4cac-a6f2-a0f1c8e1f5ea", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623675656, "uuid": "bc42ef8e-2929-4f5d-b679-1b99c27f3f29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623675656, "uuid": "a348ccc6-f392-44f3-b5c3-48696a9e8da7", "value": "SWIFT INV 060821 DE COMEX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc3e914-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623651955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651955, "uuid": "b9c7002a-bb0c-4ab8-93e6-2f57d0aac5ed", "comment": "Malware payload (AgentTesla)", "value": "faace35c03c9c832f0550003af052ff9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651955, "uuid": "a672a4d4-00e5-42bd-93d7-ab70a3a2d504", "comment": "Malware payload (AgentTesla)", "value": "8417cc20eae7fc71ae18567c9c78d821ec967c11b3359b57721288b7ea67f40a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651955, "uuid": "ce2a17a0-fed4-4ad5-b9e8-2e8bf99036e4", "comment": "Malware payload (AgentTesla)", "value": "ef42cde6f4e85bf12341a77987f5732b5534b7c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651955, "uuid": "1c530403-8ae0-403c-9c30-37feb74507f6", "comment": "Malware payload (AgentTesla)", "value": "638db6fa505391a8f2e60ce2ac33ac26287ac00325c31f5a3a493a2bf3ddc5a553d5b1433b9aee70996a1c5012c549f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651955, "uuid": "ff0fb2e8-eb95-4d81-be4c-5fff7ca3dad7", "value": "4405F1263254EE52C3AA2431DCCF511887FAED4336B3EF256D8A33D90512B92DD1A5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651955, "uuid": "1aafe1f1-867b-4d72-9885-d6a65340d8ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651955, "uuid": "3d05b93a-c98e-4d0e-9414-5b71854cded2", "value": "24576:rYtnsjUVYtXiZ/1g1LD17i3C9hlVps+cJuespZRI/F6:rYtiUYtXiZ/XC5Vq+acpZa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651955, "uuid": "5dda4d1c-40d2-48ad-820e-8f64fd7ff72a", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651955, "uuid": "28f3705f-07c1-4bc8-a664-fbfdbe3490c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651955, "uuid": "891e621c-d7b5-495e-816d-8aade2e9b719", "value": "Shipping document AWB 80258723268765pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63de9bbb-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652391, "uuid": "15e22a88-71e4-4941-b87d-62c36050f181", "comment": "Malware payload (Mirai)", "value": "979cc8a0d70d6ee4c17e0e4482eecfad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652391, "uuid": "087cc2d9-8c27-43e2-ab8b-e18ef4e4f662", "comment": "Malware payload (Mirai)", "value": "8434ea77eaadbeb6eebf5cec105da43009ab8c2ae142f0816a1f690bd98f7d97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652391, "uuid": "260796f5-bc5b-40e9-ab97-562e30e7944f", "comment": "Malware payload (Mirai)", "value": "0476946a3866f7555177a3cd513aebac6d3b112d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652391, "uuid": "343bb99e-e038-4f23-b965-dbd4781d6ac1", "comment": "Malware payload (Mirai)", "value": "c8ddc9cdfe2a5625cd24c83907e956b0c34951feca2285f29ec33f3aca16db439e2c1cd9586e803ac7ca7eaee0523f61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652391, "uuid": "34f883f8-fc55-4b82-9acc-723c3bee589c", "value": "B0F34A93F911DFBAF40BD33A04D30A25B270BFA64F531262731B39A6AD362D41827E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652391, "uuid": "a8b5693b-ac80-4fed-9fdb-b5d6a913a7bb", "value": "3072:8UhvKkc0s5NAm61L0RfmVO8TBcF8Z3udUdf0PyUHlCOKkmq0ncOLxJaBMrK:5hjcb5NAm6pgOVO86OWyUFCkmq0ncOL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652391, "uuid": "6c4464f1-a2f0-4883-9992-53991ec44620", "value": 161154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652391, "uuid": "b00fc061-31ce-4f70-847e-619c5b883e14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652391, "uuid": "26502647-a936-4adf-814b-18db901fdb45", "value": "979cc8a0d70d6ee4c17e0e4482eecfad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b228826d-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658535, "uuid": "d5f9247e-0c5a-44d7-9ef8-8d91ed251c2b", "comment": "Malware payload", "value": "6c246ce24c1cec788a85d6d1be05efa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658535, "uuid": "1887b46c-3eec-4d6c-99d8-12036322404a", "comment": "Malware payload", "value": "849a3e76731c918716b6014d8a8d4863996d45eddc5b13b16420ebb106b3cd28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658535, "uuid": "90fc66e5-826f-446a-9148-a8e77db6398f", "comment": "Malware payload", "value": "ee82333487eb6b6dc9c56630d3a631303c0b1784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658535, "uuid": "f5efbe4d-e832-401e-9226-773b39e3a7c5", "comment": "Malware payload", "value": "d6f325c64ec5a038894da2520788102ba1519f33da4f50b1360fbabd4b068a60e841e64af8d4c5e454572bfb3f2c222e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658535, "uuid": "f6381d9f-1464-4f36-a2c7-2dab9639747d", "value": "8F0502006291C0F4F0F716F96A7A9F39A9ED7EB0A76864DF53C526DA16386D0AC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658535, "uuid": "8b00d6a3-7f50-4ed4-b799-b28dadec8917", "value": "f3b31e907320cadf5820c6eb76eca851", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658535, "uuid": "6e31df78-0776-4b40-a94f-5c8dbad0e747", "value": "24576:BFt2ZAOfNGC9IQ/0EkUSA27Y1pAxM+d95PG+x0fE:Bf2rkC9cE6AaY1pAZbNG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658535, "uuid": "d43bfb97-5b1e-44c4-9980-d9df721f4ede", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658535, "uuid": "57052d73-b023-4c3b-8279-a3eded9dea80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658535, "uuid": "1fcab559-a45a-4da5-88f0-44e8fc1cfe34", "value": "6c246ce24c1cec788a85d6d1be05efa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d73bb99-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623654501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654501, "uuid": "f0689b7e-3dca-4d50-bb08-ba6748ca7576", "comment": "Malware payload", "value": "3df00cd76b24ce387bb324c283711ec3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654501, "uuid": "ac165ae3-83a3-4d96-b290-03d24e602dbe", "comment": "Malware payload", "value": "84b071661a487fc8f56d3e424740269aad1cddae0a16d84bcdff9aa196f2459a", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654501, "uuid": "a9810454-0f81-44ee-ae54-2f53f9563cdb", "comment": "Malware payload", "value": "598810dbcf52866a6a2518ff796dfacaef9993d4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654501, "uuid": "536029cc-caa5-44ee-b81c-282bb157c918", "comment": "Malware payload", "value": "80e121104d9ee3f3a892943e03a3a94cf6e1068089bf1bd1aaad52eb27414a07dbef70c6c7665a6b7c4722e115fbb75e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654501, "uuid": "db8edbf6-207a-428b-a2d0-ee13d0725b4d", "value": "E8E42347E52311D2E37B39F73F6AE098661F71050C9F69286A8A8DE4212752707473FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654501, "uuid": "21f0134b-d69c-49c5-8e15-b9ef5a235fa7", "value": "12288:ZroGVWB+Iud6sSiQmjyaJX4rgCOvJjlEfsHFq2KADfnyfjWTyM0g:WGVUXuMXn9azxvfdlx7fmvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654501, "uuid": "73a36eee-8dc1-46b7-985d-1e981696596f", "value": 700927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654501, "uuid": "b91b3820-e08a-4d00-9ce6-6686d7209efe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654501, "uuid": "1004263e-5d48-4a6b-9d4a-0355b9a771b0", "value": "INVOICE125POR.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab46f32-cce6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623657610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657610, "uuid": "fdcf5c07-a6bd-4837-a62e-84c287ddfa13", "comment": "Malware payload (Mirai)", "value": "a36e4d85017c7a4e3ce8ae84f235e4d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657610, "uuid": "914832c5-4ac7-4275-8889-31ad5b592cc2", "comment": "Malware payload (Mirai)", "value": "8518c0323365c1398c3b2a017bccc954c6c9a127a72b5f4a96f695af2c55d19b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657610, "uuid": "b3fdaa69-e52c-489b-84b2-340baf173558", "comment": "Malware payload (Mirai)", "value": "5c3667c2d30660e05c537f1e0207e4e620d1d931", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657610, "uuid": "ea4e71c5-549b-4882-bafa-72238e8d4176", "comment": "Malware payload (Mirai)", "value": "27f40f17aca16268f61bfc3cb16bef344604c0626979762eae13e26e6027c8b03880fe233172167688a917b9fcc38e8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657610, "uuid": "c38ddd45-e180-423a-95bb-af032e4132dc", "value": "16232AC0A103E9F9DC6A017430A6EF329FF6F4F6221DF997D3A996236C51601A907D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657610, "uuid": "0da03fe1-31aa-4b41-81b2-d235bb5f8355", "value": "1536:kXTow+N4VVSBZhKhtVHQCaaWYarU2N6Xr0inG:YswI4VVSBZhuVwCaRYarU2NUQyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623657610, "uuid": "46d48cea-0627-462c-a5ee-af1b581d2f67", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623657610, "uuid": "679a7b02-1947-4d49-83e8-c750943fe0e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657610, "uuid": "a6e33d81-a851-4c63-be35-73cf5901c228", "value": "Frosty.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446d93b7-cd1f-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623681974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681974, "uuid": "2b60f18f-5b25-4b3c-937d-7d9c5192571e", "comment": "Malware payload (NanoCore)", "value": "62ffeefc4bfff036c7247c8cf49d1dc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681974, "uuid": "1615210e-290e-4400-875f-94c71d17ed74", "comment": "Malware payload (NanoCore)", "value": "8664d06eaa6552be1e96d54de3761b63f4abf18058630eb30d3e344d9734f7bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681974, "uuid": "f0b9bc9e-9b54-4058-b209-305c3fcf49ac", "comment": "Malware payload (NanoCore)", "value": "066da0e48c82bc8cf15b76d62984653d5b49e89f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681974, "uuid": "cbab165d-9b62-4ece-9e58-3827c29b64fa", "comment": "Malware payload (NanoCore)", "value": "1ee5284d63af5d4d49e21fb52427780c347caf004851c02c81c56e5caf3e596b3364ef087be8592ad746d2188947ebfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681974, "uuid": "95985b76-bf9b-460f-b3c5-976447a4807b", "value": "CA3512247694AB21D13DCBFD5465100153F1A217E732CB9EBEF895E61B92F8286B23C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681974, "uuid": "c24b67cf-aa62-4341-a74a-6fdedeeba611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681974, "uuid": "f1372554-90ff-4053-a6dd-6e01ac19bbe9", "value": "24576:P4XS5sELuYA5O/iTW/ch8hUr6AYI22cFottBPTTy9i:PmS5sLB57TWSxr65IJ4otzLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623681974, "uuid": "446fc30e-882c-45a4-89ee-7fa98473b95f", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623681974, "uuid": "bede7b8e-5bba-4840-af43-2d6bea899c21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681974, "uuid": "99206a59-b12b-4c00-9439-f80fd65f43f2", "value": "purchase order june delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca22aec-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623658338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658338, "uuid": "6bef2f9a-8d85-48e8-9008-c24c54066e37", "comment": "Malware payload (DanaBot)", "value": "cc048bca328cf7aad11522d87937aa69", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658338, "uuid": "aef92de7-d58c-426c-b96f-5b16c5b96d60", "comment": "Malware payload (DanaBot)", "value": "86e391bb9f6683b4658de6d256c244a08ecae308097007ecfbb8e73b32e1cfba", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658338, "uuid": "148c49f0-47f2-494a-a1df-4b589ca29681", "comment": "Malware payload (DanaBot)", "value": "4bda7b496d111dcb2231294f483b9dac183a6308", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658338, "uuid": "4d33c237-c040-4854-9b38-487ece879140", "comment": "Malware payload (DanaBot)", "value": "bdcdfa33e896233d031fd7fffbdd2c4e3f7b0a5bd6674b40d681b1ad5b6b355f85d87d41934697dcdc09a498e9050a07", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658338, "uuid": "d57685cd-b8d6-451c-88a9-ce8179f80101", "value": "1B563310EB70D0F2F4B362F559B4CEA494A9BED1232A62DF27D60BD991241E4FC30A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658338, "uuid": "e86fee7c-2d1e-4cec-8b55-2ebdf7fa53bf", "value": "57a9c8032d4f45ba506b77ea4c7334bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658338, "uuid": "4e9f1854-c330-4276-96ee-cde969488e62", "value": "196608:qwEZME/8kA9f+etxLkk0AL42PApmlovdJj+6:qFeE6Get0jDpmloVJj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658338, "uuid": "38a6f75b-59d4-4e90-815e-04d4078ee3d7", "value": 6334976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658338, "uuid": "930ae3ad-6afe-4678-8410-dd975f46abb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658338, "uuid": "1f9b5f27-c92a-4b79-9d24-bcc0e87dfcb0", "value": "cc048bca328cf7aad11522d87937aa69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5515cfc-ccd8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623651669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651669, "uuid": "290dbb0f-3159-4c87-8cd8-6b68af0cce89", "comment": "Malware payload (Loki)", "value": "0bfced6fc97ad358451aa2f1c9da7c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651669, "uuid": "e35f2d58-d3fd-4e8b-92ab-a463e9479f67", "comment": "Malware payload (Loki)", "value": "876cfc1e5f6783410512da938f532bf79b93caa5c1c24975be8114282b6bdbd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651669, "uuid": "63d0df64-c80d-461f-93ee-6028b677cda0", "comment": "Malware payload (Loki)", "value": "bdb9a65868566d3a01eb52b8f43c2d7e553a8c77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651669, "uuid": "5dc3b27e-2f6c-406c-a2cc-87631b670aa9", "comment": "Malware payload (Loki)", "value": "da9e82c592c094f1ffecfbd5e6b1efe1e3c56a4727a95ad4256209cdc32dca36cf557825919643f7ff2c411855d6f1f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651669, "uuid": "8ca8ef27-29cf-45a7-a34a-8b3edbd10b3b", "value": "30B4384F7952A3AFE1D80C329493942D973B7CD52B0372E125827B6BE8770296B42F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651669, "uuid": "3803c7ad-f81a-4ee1-bc3a-c076ee6ed490", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651669, "uuid": "d2dbb434-8c31-49bd-a3e0-1f104c7d6350", "value": "6144:XQqJnWDGDAXSjmrBjbiiJHgncJ4drpMFp:fnDjmr8iJHgncJ4draFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651669, "uuid": "adbe16d3-ceb4-4ce3-ac08-0460d2acb4b3", "value": 526119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651669, "uuid": "2204d42f-d243-4689-96b6-525ee76d486b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651669, "uuid": "8aa22014-f307-440f-a4dc-42c64f6d94ab", "value": "Altho B.V. Order 85673.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0af79e-cd0e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623674633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674633, "uuid": "326f8012-ab21-4742-8a18-7a5c24193108", "comment": "Malware payload (AgentTesla)", "value": "c8217715ef55fe5f5643a6cc6c7b797e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674633, "uuid": "c2839b06-ba90-4e24-bcfc-bb3f833da5fb", "comment": "Malware payload (AgentTesla)", "value": "877a10d92f5b06000711b96af3b0705ff13494b7eb38804adcf3f207457cf51a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674633, "uuid": "b9a9e20e-0a8a-4dde-9778-e70f99b3ca83", "comment": "Malware payload (AgentTesla)", "value": "c0e533a61b6dfd4c9fdab7b0dfb635a296e1d86d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674633, "uuid": "fa786fd9-911d-419c-b7a9-37bd353c64c4", "comment": "Malware payload (AgentTesla)", "value": "f5ac3187eaa541d3712a91e25e44633b8e3faffe6bbe58354f3f1155de2b710bfff8d6eed93c4d1e9b74482e99a8f7f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674633, "uuid": "c0704714-49e3-4ccc-a456-b297895c19d3", "value": "C9E4D0367344FB6AC2260F3AC4230484A3F2914B7272F75F68DD29F85E52B096B6E547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674633, "uuid": "81a0e96b-970d-42d3-8865-39df670dfe5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674633, "uuid": "7b55d13b-320d-45eb-b957-87e41a9c8438", "value": "12288:A9SxjEXUaKM4GSYbcbfwgOoc4pHG2OQE41:NhEXUaKM4EJovpEQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623674633, "uuid": "3197747e-4028-4037-bef4-f97dafb7764c", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623674633, "uuid": "c46852a5-d99f-4871-9f93-c5cd90a32924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674633, "uuid": "4342cd28-b476-432e-9e77-8a63a3178df0", "value": "c8217715ef55fe5f5643a6cc6c7b797e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b297600a-ccd8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623651664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651664, "uuid": "aef8fdea-abc0-4301-8e7d-f0b17b2aef4c", "comment": "Malware payload", "value": "db473c4883518977aec3af234427893f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651664, "uuid": "57525e20-63a0-4b97-9963-9a5a53a7f68e", "comment": "Malware payload", "value": "8795bb17e6a0ce6dc06236d4042c625f2154bd1d8e5df494c23ffa3e58124395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651664, "uuid": "6d49bcd4-7b5c-4b32-bb09-19b5fecc909a", "comment": "Malware payload", "value": "8d0ebd773014398eb0deb2e4015eb5678c466e6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651664, "uuid": "17b3cbf2-77a9-48f3-a78a-61a007e8b368", "comment": "Malware payload", "value": "190c7f873cf7c5be29c4e9b23ffe790000e2f42d3341c46d3f296b1416843d1ea49679f78f7f7f6a6cd41e6f74d7a4f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651664, "uuid": "44c713f0-a32e-4701-a57b-ba6c37c94be0", "value": "65531A15E6D0C06CF8E100BBE5E6463E982ABE70134D50C7D3E2AC575BB9AE7793085B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651664, "uuid": "27d310d8-88e5-4cca-8ab1-aa2488e36c7c", "value": "c7694ea8cad925517a690294a183adc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651664, "uuid": "32a2d30f-c86b-4084-a22f-3d2bdcdb5a64", "value": "1536:RxCoBvIuzOuy+wLJFxR9eOhGGHU/aYZdkc6u6y:RxCoBvIgrLW9R9eyGGH6dkc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651664, "uuid": "58367209-5e03-41b8-ac83-f5953f04df72", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651664, "uuid": "84484bd9-14ca-4abc-af6d-73094be38a27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651664, "uuid": "7e4fe839-28ce-4b15-8e9b-3dd373d969ee", "value": "db473c4883518977aec3af234427893f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c848111c-ccef-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623661579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623661579, "uuid": "8bc2e41d-731c-41cd-9ea3-d73d06f3581b", "comment": "Malware payload (OskiStealer)", "value": "24aaec81adb7f8b9cd297d25527722b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623661579, "uuid": "143167d6-fa86-4ce0-86ca-9e3f3ebf8eaf", "comment": "Malware payload (OskiStealer)", "value": "883a09e11580196cacfe621972de027175c34567c9d297ebda9394a29c6ac055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623661579, "uuid": "da2f0672-711b-467a-98d0-704cd1b07d09", "comment": "Malware payload (OskiStealer)", "value": "f617ca9aeb784550edd46115e7fbad1531c7052c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623661579, "uuid": "be314b62-6918-4c54-9d59-1a26ed78ba34", "comment": "Malware payload (OskiStealer)", "value": "41a7b72388616ddddcd17f92ac456a5af1135974def9bebb42be19b1c38817c18695f2daa9ffbc84018d960dc226ed4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623661579, "uuid": "44a33e94-5c8a-4d3e-9b43-0f03a2371f57", "value": "27B402D0B052D4DBD9740871D293E6B69BEC242A65700EAF77C85F1A315238B502FEAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623661579, "uuid": "fed25611-1c69-4aed-b3a9-92db659f4edb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623661579, "uuid": "766be737-487d-49b1-8772-99ada4677e2c", "value": "6144:7sKEAhcZjLm9qVoZ/yISdV6IhAZ7HzsuESyHgBbrv3LqsNZyQTpZ8qJEA/xVw4Bt:HEAAuSzpClUSyHgV/5yQBz1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623661579, "uuid": "78a2dbfd-bf48-4e21-98f3-aec52a9e2a87", "value": 494033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623661579, "uuid": "6bece999-402a-4733-bcf9-fbfbe6af11f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623661579, "uuid": "24d46fc4-e443-4867-aef8-b4b6a341c2a5", "value": "BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7be7d36-cd30-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623689522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689522, "uuid": "57564d89-f065-4f5e-93cd-0f27f7157666", "comment": "Malware payload (RedLineStealer)", "value": "e6e9e6a1d44c96471c367efff38a01d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689522, "uuid": "bcc9add1-127f-47c6-9b3c-cd8cc1e057ad", "comment": "Malware payload (RedLineStealer)", "value": "8852c808f4beb15d37457e26d23a155e25b83ebb7c48dcf83d3c65f4871aa174", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689522, "uuid": "7b6e97ac-ecaa-437f-a7ec-73b7b7c25bb1", "comment": "Malware payload (RedLineStealer)", "value": "f08bbd55b4a41544210fd2968774302cfa07609b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689522, "uuid": "a5ae7bdf-b751-4107-970d-86efa48d2ac8", "comment": "Malware payload (RedLineStealer)", "value": "a1459722f17c9f2e6448d435d66412014e0a616026cc42ccc1c6523141145a901d68890504a646769f5d4e3267bf2762", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689522, "uuid": "bd413586-6bbe-4407-918e-63b06c570582", "value": "4CD40135B64185BBC0620935885BD3B6B53AFB001B7C55CFB7DE0A2C9D2334A3E69399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689522, "uuid": "c41f9fa5-df33-4b3c-b855-292b8e15c4a0", "value": "b8494300a1f7342d4c600a7b12e15925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689522, "uuid": "9547d0a6-6e27-45e2-af54-65f348de7f3e", "value": "12288:1XmwRo+mv8QD4+0N46rNNQ57kekvu5q+2+8WEAYEfPnZp+:1X48QE+UpEwvu5qL+Tv5p+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623689522, "uuid": "cdfa6e44-a826-45d4-9e14-adbb12a3dbc6", "value": 614258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623689522, "uuid": "b380f963-7266-46f9-8991-4bff84854d47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689522, "uuid": "66d3cf86-e0b2-4448-ab0b-804bfc15ecde", "value": "e6e9e6a1d44c96471c367efff38a01d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f642cc6f-ccc7-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623644476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623644476, "uuid": "7a2a2a78-9994-40ce-aaf5-1051493bfc94", "comment": "Malware payload (NanoCore)", "value": "98c77e758a852fe5c0884cc7897339d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623644476, "uuid": "26c678c6-eda0-4c96-bd76-40313e37e2b4", "comment": "Malware payload (NanoCore)", "value": "8971ec3505739bcd5dc12bb69ae3fa3ba4f43f2ff0e53deae6b694d20f4a751b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623644476, "uuid": "2eca749c-2461-4b8c-84ec-9e79412ce7a1", "comment": "Malware payload (NanoCore)", "value": "87d7914bb7e6b91e782a2370f46ceb11ced8c23e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623644476, "uuid": "b9683d39-90b0-44bc-bfcd-09f4d528a494", "comment": "Malware payload (NanoCore)", "value": "ae90d08505d6103958bc0a6b22695ba4b7bfcdb57438c666a5d90a3eefcfe94d42f13fac454692e67787be1b6896162c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623644476, "uuid": "4e1031ec-51d7-4e3a-904b-8a724aac8456", "value": "5AE4230811F21B7ED13E63B4462190144BFCEC2A2726CB8E5E9974F67B737560AE274E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623644476, "uuid": "23f33483-d4ee-41b7-a1da-f683989bf872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623644476, "uuid": "79b9329c-41ad-4a2a-8815-912b760ac898", "value": "12288:0tZM4e/ZUdtbUoKSSGe8mOModiyK7i8BCI4GHXQad28wPbUYRQMEENH+MB:0tNeBUdtVm8mOHdil7NQI4Ggad28evRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623644476, "uuid": "b8045530-cbe2-459c-84f6-843e83796b68", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623644476, "uuid": "811e6a41-709f-4e98-8324-7daf07cee0e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623644476, "uuid": "5cefa33f-dd81-4de9-b808-9b3857f8f0ef", "value": "Contract& Signed purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87384b0a-cccc-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623646437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646437, "uuid": "de9937f4-068c-4737-80e4-d9d55b287b90", "comment": "Malware payload (Loki)", "value": "c881e7edab6625a02d8e35729b9fd012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646437, "uuid": "fe15a0af-312e-4862-bd32-361be59d1c56", "comment": "Malware payload (Loki)", "value": "899f74453f999003d2f88d0a25987d85b3fb69eacb1a9fd36641736568e01baf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646437, "uuid": "53aff524-7ef3-4d53-b057-4cbf5b5eee3f", "comment": "Malware payload (Loki)", "value": "7444e9f018a5b80b0106002b0087fb592f787c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623646437, "uuid": "a9a843b1-00b5-45e4-9c6c-ce067ab56d10", "comment": "Malware payload (Loki)", "value": "ad5003713b0d6df63423b8450268f592a77ef870416a35a5e7576e0a03afa57f807f1bc73354cedd77a098e999283280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646437, "uuid": "404db191-a0b9-47f1-9d54-9985b03f2f80", "value": "C4159EAD725075DFC86BC472CAA82C64EA607C7B931B9207901335EDAA3D997DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646437, "uuid": "54097525-4c0a-41a6-a6b0-7dbb2f20bc9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646437, "uuid": "2e7338ba-20f2-42fd-9f8d-6aed743a1a02", "value": "24576:GIZNeBUdt2K7qBon82i7a/LCLu3W3qLBgHyy:GIZwBU2bon8W/2wW3Byy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623646437, "uuid": "2fc181a1-cf43-4169-90b4-bc69035f4743", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623646437, "uuid": "79b04f4e-6dc0-467d-8c6e-386b5d777f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623646437, "uuid": "8c282ff5-2efa-4e77-bc45-392bcdaea40b", "value": "\ubc1c\uc8fc\ubd84(\uc2e0\uaddc)_10115_[\uc0c8\ub108]_210614.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64607c96-ccb3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623635642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635642, "uuid": "ac60eb99-db96-4c99-b804-a3180fe087bd", "comment": "Malware payload", "value": "f2d554878a36b0fbe90672b19b519a72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635642, "uuid": "8f565a1c-c1d9-4d20-a927-7567b8cbcaa9", "comment": "Malware payload", "value": "8a0f1063627e070ffa0f9d5729cdc445c721a8a244402b6a5db8f5b9b146f50a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635642, "uuid": "bcffb4fb-d667-4274-9408-2eafdcadb41c", "comment": "Malware payload", "value": "3e165d43a8e2efa10025581356a56c3e17a653e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635642, "uuid": "9c9f4439-3667-4c9e-90c0-4cccc0a701d2", "comment": "Malware payload", "value": "4e2eff42fe5b6b2321a96c33f9eae720ae4cea8562ee09a96b2e61aeb10755dfb7a6f7ad551c4db4286bacd973d8d7cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635642, "uuid": "b10f1477-6df8-4ebe-b7aa-201c49e091aa", "value": "A0C32997F800DE66F40AEA7601D70B35B630FB714E531A7263573AA69E362E07827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635642, "uuid": "fc50302a-cb46-4b3d-997a-cf50f1f88cd5", "value": "3072:K0dEKjFTa7d9wV11AaykS2J3wPgsLmvI0PDGnSQNER:K0dEKjxa7d9w5ykPJ3upLmvI0PDGnSQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635642, "uuid": "76c91bb4-548f-4071-9d8c-2d3b6b344f58", "value": 118294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635642, "uuid": "394a0838-5850-4d97-bd14-f9ac8cfc6412", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635642, "uuid": "eb7fc907-11d7-4949-90bd-5f55844aa70e", "value": "f2d554878a36b0fbe90672b19b519a72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034533b8-ccb7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623637197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623637197, "uuid": "dfbdbd51-5d76-4bbf-872e-b28036c33fc1", "comment": "Malware payload", "value": "e5dde321e392f8961d59a7bb9283b9dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623637197, "uuid": "af278e59-2e11-4cff-a59f-3bd1193c62b3", "comment": "Malware payload", "value": "8a7294acb207850248b878e0fb0c28a511425a1976ea97647a49df5a2065bedf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623637197, "uuid": "b3e1a043-923b-4ab0-8ad0-1bd24710b413", "comment": "Malware payload", "value": "1947a0fa8ab80df8d8d780a859caa0114f8bf61f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623637197, "uuid": "619edb8f-1ffc-482e-9706-51274f69bbd4", "comment": "Malware payload", "value": "fcfc4cf293e1e00134bb22d2d7cf2ac58d22b7a40a0ae6f13709d4328a6a54db6b91d8fb3432805480c1ca0996c9168b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623637197, "uuid": "cf31cea0-c34f-4161-91a2-ff68f0a6751d", "value": "F72602207E82C132E5A281716D7DEB6A54F8BB750B7581DBA3C80E2D1D705C36B3A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623637197, "uuid": "be918025-ffad-4886-bed1-2e0f20fda50e", "value": "d9c9b2207194e3b00f67e3fec7ad5f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623637197, "uuid": "e5c8ed11-1032-4279-a966-59eef2f9ffa9", "value": "98304:31wpL+lIIWn5P3dipbX9DZhshMK0L7AuQzjumyCzEpqI:lw4PG5P3KblZhY4LQuZQzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623637197, "uuid": "fe2b8889-367c-45f9-b218-21ae71d55bb2", "value": 4693928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623637197, "uuid": "4a220d03-178a-4b8b-80fb-a2b57d753872", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623637197, "uuid": "fc758cdf-e414-4384-97ac-734ecb6fab43", "value": "e5dde321e392f8961d59a7bb9283b9dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2515ec-cd10-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623675514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623675514, "uuid": "bd88d9d5-ac00-4533-b526-17f0a5ae99f3", "comment": "Malware payload", "value": "e7bf3080a2c017df04e38c7f036e507e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623675514, "uuid": "968b6f81-113d-4623-aefe-8c4617de3bc1", "comment": "Malware payload", "value": "8b95785a2f1ca7dbc66f7dc86970605d8ed704e0c09dbd82f2e0e82f909d6c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623675514, "uuid": "256481a3-6b22-4553-9d60-2757fa856851", "comment": "Malware payload", "value": "12474a6bed8a1fce3654cb2a5f2ea9dc05abc937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623675514, "uuid": "9a5caf09-ce1d-4b0f-b56a-715b387f5a56", "comment": "Malware payload", "value": "e23e79aca5eb9f99356176c37c29414ea6003d24e8d18827b049401268304ab5e80b27ac0e6ab529db6531906ba555bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623675514, "uuid": "8a529e7a-5d98-4537-9fb9-5fd6cf51484c", "value": "5BF4E0AC726075DFC86BC475CAA45C64EAA07C7B471B4607902731ADAE7E983CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623675514, "uuid": "33588e75-b80f-45d7-90d9-93976f70cb63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623675514, "uuid": "49e5b3e9-2f44-429c-975f-67a9040b0d5c", "value": "12288:kZM4e/ZUdtbjXsTsQ6x7Pa13DNEgpSMpnqc46ov6gd5jUxKf3K1oPLwKbllsm6B:kNeBUdt37T7PsZoMpnRkEKfa1ozc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623675514, "uuid": "2c11219a-2ac7-48e9-84c6-e92b91777479", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623675514, "uuid": "94a55c11-33e3-4052-b19e-494603e10f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623675514, "uuid": "e5a0a1b8-b00d-4d98-aa0a-f7587e33d09e", "value": "AsymmetricKeyExchangeDeformatter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aca38a0-cd22-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623683192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683192, "uuid": "8e76c076-f5c5-4bbd-a002-60c81551ec77", "comment": "Malware payload (AgentTesla)", "value": "4277a3ce0b82fde10773aa321ba06920", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683192, "uuid": "2032f917-fb66-40ec-b4cd-e5b700426002", "comment": "Malware payload (AgentTesla)", "value": "8c7f7884b92c0072eff7114e14f389fa9d6d9fc5d1fa4e42d7a63f18ab5ae306", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683192, "uuid": "814f3421-cd2a-46bf-9385-d7a4271659ff", "comment": "Malware payload (AgentTesla)", "value": "f7589008d875d358f5a37dc2da4820ba1f5def6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683192, "uuid": "0a807f8c-0fe9-4327-b290-28281dcf508f", "comment": "Malware payload (AgentTesla)", "value": "046ec2fb1c2bb0a1cc46bd2b463ecb8424f503d45126c25ad4df5124a74c2c4362c13edea1bb33906ca6448aed62d544", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683192, "uuid": "32aa579a-9a59-49b0-8a22-893344e00e24", "value": "AAD42361DBB6711CC9258C118CFC13630AEB945F241DDA70B68867A4493EFBCE6DE2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683192, "uuid": "e35a6da8-3ee6-46ce-8e78-0bf17f460b3a", "value": "12288:he9DVziKR/fwYnl9FfJZfkUgA/Lo7ct4wPgIXR6RoHn40+TlRv9iRa:Y9xiWfwYl9FRZfknA/YcawPgzRof4SRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623683192, "uuid": "89906c9a-42c9-4b44-971c-c3e552ce4882", "value": 597948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623683192, "uuid": "7a530269-84d2-4f6c-acb5-0df3ffd0e224", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683192, "uuid": "4597484a-f2d8-4e0c-9cf6-60e85bd2aa70", "value": "TEC GLOBAL PAYMANT.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33529e14-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623658323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658323, "uuid": "bea4ec89-258e-4c2d-91eb-9aaca3af1adb", "comment": "Malware payload (RemcosRAT)", "value": "49c2aa79583d208363e567f7176c62d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658323, "uuid": "218d571c-c71e-4783-9e0a-12f43338b801", "comment": "Malware payload (RemcosRAT)", "value": "8cdec76d97a727661fa3f3ab5eff68b7be5e13f2ff024e4ab69cc6097ee2390c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658323, "uuid": "4902fd89-1096-4885-b835-289421c695bc", "comment": "Malware payload (RemcosRAT)", "value": "c29b76a085d83ba5032374f8517ec60dfe67c0eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658323, "uuid": "8126ebb2-60b0-4730-bdd3-d59ccb5680e8", "comment": "Malware payload (RemcosRAT)", "value": "8004b41932dfb10a0eecf9b822fdbfe55333a3a9ab549859f7fa3422e54e7618081c45853c992e711fd72801ced1047a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658323, "uuid": "1470f397-b02a-4dbb-a4e0-ae3c4c301bcb", "value": "2005121037D9DB69F2BE0F394475810007F9A126EA29DB0C7EDE25AF2D33B4A875425B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658323, "uuid": "999846fc-800c-435d-94c2-02d2496acbf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658323, "uuid": "84b4a782-5976-40c1-ad58-41c95f5e2ac8", "value": "12288:998nSbgHGt13ajHra0jZM4e/ZUdtbv15D+fGWZrYJchoyOW6MzetrE2iKYhD8zux:WrrNeBUdt7eOMQMzepFiFslJIuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658323, "uuid": "646c06b8-437d-457b-8387-e6aa63ae50fe", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658323, "uuid": "f08f272b-feec-4df7-9ccc-d3c01d7963a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658323, "uuid": "c4a22502-c009-49b9-bdd7-9180f7720076", "value": "49c2aa79583d208363e567f7176c62d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8033267-cce6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623657713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657713, "uuid": "c374d6bb-0b45-4358-84b4-e45dda04233d", "comment": "Malware payload (Loki)", "value": "a2dfaae08904cc007d1547a6be6742ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657713, "uuid": "d0a5b9cb-e3a3-4e1a-b14b-7e43df58cd0c", "comment": "Malware payload (Loki)", "value": "8d16dd61801e98edb52b1590796329b303ba1c5d75501884472a96387233db5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657713, "uuid": "ea4ff2c4-d61e-45bc-8e63-195daf4bb1c2", "comment": "Malware payload (Loki)", "value": "c0383deb9b0e09eb6063c5cc435671e95d32e3aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657713, "uuid": "260f9499-234d-4a2c-b395-712eeaa529d6", "comment": "Malware payload (Loki)", "value": "05097bbd387006ebf313c448679c3c4f5e1071898befaedb6a7ebcada7e02725df4da683590ce46ec04bd3fa848338a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657713, "uuid": "b17530c6-3949-4d06-a03a-dbd64a3ccdc4", "value": "628402143BEAA019D1729FBEAEF4738195AAF2362A03E74F2881134F5517F81CDC1676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657713, "uuid": "392844f1-0070-4779-82fd-bf5428aa4cb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657713, "uuid": "020d6424-5187-478f-8d47-7c04cb02ebdd", "value": "6144:M+H3f7ac1hn6+bIwUh+LFM3ckpwnsWq3qvvbe6xWrzGmhRLrEvFFoqIRBfiU:My3f7ac1k+b6nGsDse6qDbgvHmLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623657713, "uuid": "f7c06aab-93f7-4d43-a0cc-ec935184e802", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623657713, "uuid": "2097aa70-aed6-4485-a112-8f471947c331", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657713, "uuid": "9d2da58c-82ec-44b9-831a-6bd7ab086a63", "value": "SecuriteInfo.com.Variant.MSILHeracles.18248.31707.32145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2c8c30-ccb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623635359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635359, "uuid": "b0d2a971-05bf-4565-ad9e-8f20baab00dd", "comment": "Malware payload (Gafgyt)", "value": "df17ec61fc0650f5a8b86cde476f5e9b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635359, "uuid": "ee36d1ca-6b91-455c-8f16-3865038ac2a1", "comment": "Malware payload (Gafgyt)", "value": "8d71dda7edf50769147452305f4266b97656cfe6f06152085f83d838fdd2a3c5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635359, "uuid": "4920203c-ba7d-41a1-a947-191e94ed58c1", "comment": "Malware payload (Gafgyt)", "value": "d43d5d3656832be511bf93ddc25c103830a44b1c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635359, "uuid": "fed28a9f-186e-45bb-948e-71d664acd2e4", "comment": "Malware payload (Gafgyt)", "value": "62a74f847bf9dd18e2c5d9ebe7d450290a6f4cc24a0bab17b755bd6e0850ac01f464de79905fcf9c75a70bf13d40e9cc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635359, "uuid": "a5c5b6bf-a38d-438b-aec7-6287532b4f71", "value": "2DB36B176692C5FAC08342B92BDFA1618823F6790B36721773C4BDA43F158CA6E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635359, "uuid": "b4b5434d-dd25-4f4b-9a70-59a054b7949f", "value": "3072:dV2nNza9qRBFZm4z1EYfcbJCphagfnJv03CKPCNVOXinYuM8R:o3Vm4z6Yg0pha8JcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635359, "uuid": "7fd39346-094b-4976-a789-1fa902f114ee", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635359, "uuid": "fd964328-40e8-40e5-a8c3-c0fcb3ab3757", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635359, "uuid": "4b8fda40-5b65-4896-bfb0-7d427987e566", "value": "df17ec61fc0650f5a8b86cde476f5e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758a047e-ccd0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623648126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648126, "uuid": "6f96d8e2-7859-4222-a2a9-e0ca299a0945", "comment": "Malware payload (Formbook)", "value": "15f7f83b186e80f4bb0b86077f90b2f4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648126, "uuid": "376b37d0-8bd6-4dd7-9438-7ae9227385ca", "comment": "Malware payload (Formbook)", "value": "8d8cf7ec30c5c05ce315c8fe411f83966840adf03047bc032d9f776740fbe742", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648126, "uuid": "4e161b18-9a5c-4785-80c3-d451091ace10", "comment": "Malware payload (Formbook)", "value": "b46d6bdfedbe1adf0c32a0714e25e3db35e2e2fa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648126, "uuid": "8c18bf2c-a95c-44b4-b96b-3c1bc695bfd5", "comment": "Malware payload (Formbook)", "value": "4041dff285008993ea0653a0ac76277668af2dab3a1a8cbcb06a52204afbf897e533dcb00866b68fe9bebc2c12664f6c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648126, "uuid": "b2601a3d-8060-4367-a20a-c802c5493727", "value": "F72423D53E0B3362A340CD0D2496D3ABEE3AEE4F2F544C993238D96B5A11D76E54814F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648126, "uuid": "63532e9f-dd1e-4cc1-a5b7-ff24e6dd6d83", "value": "3072:UBGx2K7S21hpO0SgBZhWcYNPdOPphrxcFrQ+dT/7Y2Ta4T9n8I2utfK3HCx:UK2K7fsQhWcSsphrCNdTzYn4TL2qKyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623648126, "uuid": "a33c1c1e-a7f5-4bd5-b092-0754f3b7ead3", "value": 210955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623648126, "uuid": "2d25ec67-2d5a-4efa-b2e2-3f5e2116d4e5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648126, "uuid": "79ac3c8f-c232-463c-875c-923498431857", "value": "UPS#SHIPMENT_CONFIRMATION_CBJ19051700013_11Z35Q6Q80446518864888.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2a66de-ccf5-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623664005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664005, "uuid": "270bd118-bede-43a6-a448-0e8b5215dfc9", "comment": "Malware payload (NanoCore)", "value": "3b865466ffe14e6a759beb191a4b6e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664005, "uuid": "b90681f1-cdc8-432d-85c8-d5dda3507278", "comment": "Malware payload (NanoCore)", "value": "8f27bca09644b58f0d5529d40f178c7e8b933188f0f5f192bad79b3bda3803c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664005, "uuid": "03defc7f-2fad-48df-83ac-bbacb0def52c", "comment": "Malware payload (NanoCore)", "value": "7a845d3a23f5b0955119fd05f04dc500ca5a5a10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664005, "uuid": "b8758eea-3093-41a3-a5b2-30e1c9e97de6", "comment": "Malware payload (NanoCore)", "value": "f1b781f53463f91e580eefcc19cc97c389d09061de1d809fa818ecd29bd8874aac8673973da77a7ed75fea14c8155d6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664005, "uuid": "f12249fe-d519-435a-b67b-b58f7d65c854", "value": "9E15E02523888B56EA7E4734D269419053F1FC1BD329EBCDBD9914CC0EA5F8183637AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664005, "uuid": "e50da1a1-194a-41db-9bc1-02e5b9f1914e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664005, "uuid": "89659aea-286d-4916-997c-2965ef4c3680", "value": "24576:zawkTLMki31+5dQ6f8A0Ihcj0JyuK7G6+V:6LSMPQ64AZKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623664005, "uuid": "fd8dd2c2-de2f-496d-8f31-f41be8cef146", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623664005, "uuid": "c4ee1010-22bf-4f09-a047-22b349bd1d45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664005, "uuid": "61363e70-344a-4775-8127-b703e6860860", "value": "Product Listing pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fbb63d-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623652225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652225, "uuid": "1d6561f5-a898-4a42-b6a4-29167850de3e", "comment": "Malware payload (Formbook)", "value": "cb678ea47f11c469ada898872208a391", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652225, "uuid": "213f5c21-8cc6-4aaa-ba62-9490fa7aadfe", "comment": "Malware payload (Formbook)", "value": "90a74b59e44b4a76b3fceae61d803b866e58af51be0fafd422809d084093d6b2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652225, "uuid": "8761f16b-573c-4067-a658-621bbe1ecb67", "comment": "Malware payload (Formbook)", "value": "c23fb0c7ed0d4d8719838a4a35e49712dad2b010", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652225, "uuid": "f4a35624-7725-4c3e-9854-78c94405d17b", "comment": "Malware payload (Formbook)", "value": "c51eba2e48fe8ac9cb7edd39c31ce80e3fa175ac21097def7b8a5d3b7d0d4a6bb5f60896d14715d8205f835535a0b892", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652225, "uuid": "0f646419-03b7-49eb-92ad-7d2759bcaf7f", "value": "2255230BB9D91F45F0EF51FE681AC1780576BE212B95D0DA33683706A1B279E378630E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652225, "uuid": "c81789b2-c9fd-4c8e-aa39-1232f6e9c62e", "value": "24576:k6nva+s/+eGPBBnSnE8i7fuZ/BxfmwAhlCb6Hv4fP9uf:kgva+8+eGPBBnSnZSuZ/BxfaCb6Hv4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652225, "uuid": "0241d006-9784-49e2-bb63-df66f3c0f9c0", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652225, "uuid": "b09a902a-96ac-4d41-9b7b-3b2ff42ba28b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652225, "uuid": "4302ccef-00cc-4d41-a918-26a52b979dcb", "value": "PO 1032123 - 1032503.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29eea26-cd49-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623700305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700305, "uuid": "bc2de076-aa30-443f-8aa0-a2a4cad19366", "comment": "Malware payload (CryptBot)", "value": "a5c5b9d46d3fd53094950eb98b9e47b0", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700305, "uuid": "fce78276-8856-4262-a827-e7d7cae650ee", "comment": "Malware payload (CryptBot)", "value": "90ac0149296d9e41ed0cac8e96866f26e60b7585f75dddff13f67136ef694b63", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700305, "uuid": "90de83e7-7956-4d9f-8309-59a482e47768", "comment": "Malware payload (CryptBot)", "value": "f81f9a34ceeada2c74075ec882c6452a61961d85", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623700305, "uuid": "cc0e040c-20b6-4382-a1cc-371e6117749d", "comment": "Malware payload (CryptBot)", "value": "2d1d3a307a477856afce581de6868b544902fd28b9af6c7b8ca557ab65c237fdb79e0004d55eb2cdf5253d571665ad54", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700305, "uuid": "f4a8a469-70c0-4d8a-b5c4-cdc50756085b", "value": "CE851211F76747B9C21FFA753B0CE55482A1CEEF071392D67388FE0ABAE62409556232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700305, "uuid": "17ea7b55-d913-4d63-b683-f6a56f3ea9e4", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700305, "uuid": "a063b8c9-eb5d-4ecf-80b2-65e70274bbbb", "value": "49152:eUHEt2P8BBfOG+lUPWMrxzwLzRaXZcKvmal/K1x7:eUHEt2P8X9CnMrxaRaXZzrCx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623700305, "uuid": "05dbd115-a3a6-47c4-8246-f704b18f4842", "value": 1754906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623700305, "uuid": "fdf99c79-25f0-40cc-a501-6a1d93bb463b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623700305, "uuid": "d5677bb9-2a40-460b-a76f-4725cfaccb32", "value": "a5c5b9d46d3fd53094950eb98b9e47b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfc4776-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623650821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650821, "uuid": "0737bf11-1b2c-4fa0-b474-19528735735d", "comment": "Malware payload (Formbook)", "value": "a8f05496829ef24f71b599c50b02737c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650821, "uuid": "0fce9414-75e7-4be5-b863-c610e997b66e", "comment": "Malware payload (Formbook)", "value": "91f60a872e5e336db2b2811c1a93f2d7526ae5693928cb78f9740b472048631e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650821, "uuid": "d5bc0ddb-6df7-42e7-8999-2c1b6ed8dca8", "comment": "Malware payload (Formbook)", "value": "7937c75dbf90791f2d80dd4f1f7b0259c500fa0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650821, "uuid": "305ad8f6-58a7-4d48-abac-abd3c8b5de4c", "comment": "Malware payload (Formbook)", "value": "34d43397e1c702daf495c6f69f2468d134057b1a4a71519024336cf4f2602db037b1823abedb55bf17555f38abf2b61a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650821, "uuid": "de25762a-0c36-4427-bdcf-9747f4d2b167", "value": "9D4412ABB2E19D3BF09781720D376336FBB6E28C96541A4343F45FAD0E5849287451CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650821, "uuid": "4cd96879-230b-423a-b8c3-117d32bcbd0f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650821, "uuid": "343d3124-4f06-4361-9c23-6e1b5c4c0a93", "value": "6144:JPB6AF1tEKUq7agq4JIXCWLknjd1civTCOOeLxPK:FDFTBUO/pJIXCvjROMJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650821, "uuid": "dc6677fd-ecd0-4287-b353-1cb20b05b5c2", "value": 260273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650821, "uuid": "43b23a0a-1137-4b6e-be99-ed6f6b17f3cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650821, "uuid": "745c9398-5731-4dca-8ec8-aa1d13d451cc", "value": "55431096.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2268908e-ccb5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623636390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623636390, "uuid": "c5d107fe-687b-45a1-b8cf-5568c3c27c30", "comment": "Malware payload (AgentTesla)", "value": "efc46ed35bc14c6b39b034b86011e358", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623636390, "uuid": "58382633-2297-46da-8b0e-c9d5bead60d9", "comment": "Malware payload (AgentTesla)", "value": "93e5d93a217a419cd49cc911e02ece1167d7a13393fb91f9a1d5b88297a5e68a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623636390, "uuid": "9277df7e-437a-472f-80b1-73ab3bc1c53d", "comment": "Malware payload (AgentTesla)", "value": "9d93391d6f763eec332f29dd48281c4882f34e51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623636390, "uuid": "ede8a5b1-c2f2-4492-85d3-1266fa8a5ae1", "comment": "Malware payload (AgentTesla)", "value": "256744992dcfbd7bf2163a08387942119a388d52845003c7320921e100d8c5b2d085a52788225645d38e8c3fc816e2ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623636390, "uuid": "b5dd863b-386e-4c30-9cd7-d6e9dd1f32c4", "value": "8AE42334A39547ABC57E23B8C3E438428474DD2A6779DB9D8ECA70F633336E1074169A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623636390, "uuid": "7f65dc08-3987-45ee-b485-af076a21c5cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623636390, "uuid": "9892acf5-41a9-47c5-a9a1-1cdf1f2324e0", "value": "12288:7AsZM4e/ZUdtbFtzuI+zwnphAXkgwC6FZRvMtvihBiJvHcvct0vhcxGBa:MsNeBUdtHAwnpIkgSbUJUvadxGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623636390, "uuid": "ede03604-c9d6-44e6-8015-9c7a42ea016d", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623636390, "uuid": "312ead88-febe-480a-8fb3-08946ac41132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623636390, "uuid": "070e2a25-76f5-4c3c-8d84-bcd1e4ed855a", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec37bcbb-cce6-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623657774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657774, "uuid": "4aebdf03-eb42-42ba-bd8e-ad805ed87fbb", "comment": "Malware payload (OskiStealer)", "value": "e172e36dba9069177dd5b0424824e57b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657774, "uuid": "17e0f6f2-cfe3-4134-88c8-d38dcdda98fc", "comment": "Malware payload (OskiStealer)", "value": "942dcb2ff5df77ac3540d11c3eb8d59bdaf4228b19bc27d130194ba967580938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657774, "uuid": "3f199764-01ed-4c05-ad32-c3499b4d4dbc", "comment": "Malware payload (OskiStealer)", "value": "98a5ae33df83764cb82c7e4aeb92176bd42ca88f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657774, "uuid": "8f4f3dba-6997-4ce4-b8b1-a3f48c14bec4", "comment": "Malware payload (OskiStealer)", "value": "bf00551f76e21916b09c1b3e4b8ce9343210f69afafaa116fd444108a6976dd1aea89f45c9eda842da23d96b9406b8ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657774, "uuid": "c3c87be7-c0bb-401a-b53d-a634e29527ca", "value": "86342366ACC154EBD53322B10667FB37E7B36704F608355BAF6A5F6DAC421C00927193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657774, "uuid": "a118ee02-7054-45a3-a7d6-1376827427e5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657774, "uuid": "d3c80970-aecb-440e-a0e3-47b63b75a683", "value": "6144:ksZRnuPvug8L8EZ4tCBTPPhzipgqC58CGAsiF+VqlRDVyw3:3q2YlOgp85Zjsi8clLyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623657774, "uuid": "f50fac72-9151-4db7-9b7a-a50eee4dbd3c", "value": 251659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623657774, "uuid": "bc526873-908b-4541-b8df-b30cb5b09cf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657774, "uuid": "43d457d5-dada-4c44-8466-62b9c55b7a93", "value": "DOC_120229921_JUNE2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b962565-cd07-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623671785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671785, "uuid": "6bb10a46-6d8d-470f-b912-e60dde53ddc8", "comment": "Malware payload (SnakeKeylogger)", "value": "8df1010bc1140e440c7c62bd296d61fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671785, "uuid": "82d28879-eab2-4915-ad8d-d557f1943c33", "comment": "Malware payload (SnakeKeylogger)", "value": "9434ff752be66504d76e4404bc8d920748a6ae46a0e20e26c86753e8ff89b8ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671785, "uuid": "12fa6d40-bebd-4028-a5fd-a86a4a24954f", "comment": "Malware payload (SnakeKeylogger)", "value": "81b3f33534288569618e29b21df119a076ff5660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671785, "uuid": "b4c8a3c1-f30a-48ca-8c77-18ac346d9830", "comment": "Malware payload (SnakeKeylogger)", "value": "425a42e0f262355518cf5933a1a19367ae983d001e3330b1cf3ba0b80552c4406f631d0580bbad82ac614b0a440303d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671785, "uuid": "2e29336c-3877-4f08-b689-6b031e8b9c92", "value": "73F4D02523D88B56E5BE47389269419093F1FD1BD326EBCCBD9914CC0B74F818362B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671785, "uuid": "ff4a6876-7c5e-4cc9-88c7-ce6793f06ff2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671785, "uuid": "a8e1c072-df7c-46df-a7e5-dc909eb262d5", "value": "12288:V+9sheWxaTLMSeuJH1P2sZMan7NSx2qZ0bchP8p2l2jDyVE926yMqfNTG9VCZ6v:V+qcWwTLMS7h2sZ02W0bHq2jGE92kqfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671785, "uuid": "5f282b45-9b01-4e5a-9e14-d097a246fdd3", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671785, "uuid": "4e5696a5-d950-4b56-aebb-5817639c7be6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671785, "uuid": "3701e5ab-9d3e-4035-a74c-f7699770a17f", "value": "ORGINAL SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb98a49-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623650634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650634, "uuid": "0fd92928-5797-409d-98d8-10730505d108", "comment": "Malware payload (Formbook)", "value": "0e54fda7c1da855803e43c0dff87d70a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650634, "uuid": "3ad888e4-59e9-41c7-b73b-cd46bad6d1b5", "comment": "Malware payload (Formbook)", "value": "94e436107d0fb47e65907647813f1914e8c847f3d6045098e65d1bc56abf280f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650634, "uuid": "3162a620-90d1-4a33-a31e-2396f72cce8e", "comment": "Malware payload (Formbook)", "value": "4d858903f7c08e8cdd7d4463f1b17753d3928a06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650634, "uuid": "ec3f98ae-bd05-45b0-bd6a-cc937417570b", "comment": "Malware payload (Formbook)", "value": "22b09430180f2a0201f952d6fbcd69f362c2f1fe9150308deb33f4af91b13eb734ec2ad0d5f4c037f631bc076baec598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650634, "uuid": "7ff1bf56-c041-4589-9711-3ac010cfc9c5", "value": "BB24122E9AD4D8A2E9D359B007E7D333C3FF1A026411429787B10FEB2E661C74995BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650634, "uuid": "9f9d970c-9cde-4dbf-aeab-f1fa8807df8d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650634, "uuid": "8b0853d4-91de-4ecc-a297-f7ef875c96bc", "value": "3072:DQIURTXJ+MIm0fKdgYZUSdtgA9lDx14Xtmy28KCGOf9wqK40Cg2rWo2xInCKFgrO:Ds990fIRlDxeEFCzSqKfl+32xXRlxXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650634, "uuid": "074d7a31-8880-4656-942e-e6b09d62c151", "value": 224997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650634, "uuid": "ea958674-b5a8-4003-8d68-407958546e0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650634, "uuid": "fdfebe75-4771-4ee7-910a-f7ec863ef0da", "value": "Products inquiry list 06619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b426d7db-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658539, "uuid": "da91d160-8c9e-4c5d-bae0-a9470d9abee2", "comment": "Malware payload", "value": "28331f0780f3031f8e7c746bd8ec845f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658539, "uuid": "980d5d83-cef8-456e-b564-08ff0b728b9d", "comment": "Malware payload", "value": "955d3a37079121cee3f5455349c3edebe843668dfe1a0bd20602d3a6e15b3c20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658539, "uuid": "79868222-9dbb-41c4-bb0e-1ea0b9b85759", "comment": "Malware payload", "value": "26381b447a4845acf2fa91afff22d9c1b26078e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658539, "uuid": "4a686ffa-39e8-4bce-9c92-9fc5f8452c50", "comment": "Malware payload", "value": "70aedf1b9f93521aeec005b57592a22ca273211f33f97c8d5a42fb7a6d0b62bd92823c7518844adc4aca28af18dbdb70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658539, "uuid": "362e14a3-ce22-48cf-a6dc-08dc5a0396ec", "value": "64050200A752C0F0F0F756F856B69F79A6BD79B06B29A0CF53C15AEA16386D0AC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658539, "uuid": "243543b1-5ecf-4318-a47e-d06560ab6de8", "value": "f3b31e907320cadf5820c6eb76eca851", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658539, "uuid": "8af235b9-b9f3-452e-93b7-bf0b3d6149a3", "value": "12288:v2t3GM+AOLm2+VkJsov57nX7g5vefnpceJWF+o7bzYagRDKQt9RZUXYqqpz/sZ:v2t2/AOl9X7g5vePpcH57d6WQt9M9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658539, "uuid": "cfc54327-65df-4b09-9017-fe73ef7ed18f", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658539, "uuid": "8aa5b753-dfd3-4e8c-bfb1-68ea3b36071b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658539, "uuid": "0e3c1829-0b26-473c-8e2e-9dd64d34900f", "value": "28331f0780f3031f8e7c746bd8ec845f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f280d4a-ccdb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623652839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652839, "uuid": "58cf394a-4db4-47de-a697-866006018dce", "comment": "Malware payload (AgentTesla)", "value": "9af06648872059136bd4423a19daa2c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652839, "uuid": "af146eb0-ceac-4e15-a7bd-ea6164fd5da5", "comment": "Malware payload (AgentTesla)", "value": "9623e57fda0af9c788567358772340d6ac404f547b987c6278df36b61e07fc63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652839, "uuid": "10bf5935-925e-4411-b449-7b8625d606bd", "comment": "Malware payload (AgentTesla)", "value": "46d9d00012e05ee749eedc25d6f7b816fc5f8c76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652839, "uuid": "3e9da80e-639c-4140-bfe2-2f1b7c47b76c", "comment": "Malware payload (AgentTesla)", "value": "e0c5e2bde2a8d9e5c290820d078008248aca1ad5a4d438a9e29bcfcb4da417e99cb84fb15d6a02937841b6abb500664c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652839, "uuid": "41a806ff-7b2d-4df4-b4f1-5ad591de4526", "value": "16259E1273D43E5FE17EE237A629825C81F5EA57A632CA9F3D9480CE11E1F029742763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652839, "uuid": "2ade6dec-c93a-45ae-8191-788e69742db8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652839, "uuid": "3c461362-2219-4913-b7fe-1c1858afb49f", "value": "12288:uVkiWc+lfjiaGaL1XnOUVYtXiZZoahBun8FJXVJFG//cyXHSzjqyBOmFmcCHrAe:uVkrcwOUVYtXiZTGmdcSObmZCL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652839, "uuid": "b0aa0689-75ee-4316-bcb8-677d31ec14bb", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652839, "uuid": "fe8ab873-b6f6-4146-a7c8-6917c776ba30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652839, "uuid": "d786fcdb-d074-4d39-8182-c6030b68a773", "value": "Shipping document AWB 80258723268765pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da6ea9e-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623658286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658286, "uuid": "d60593a2-b7d5-48e1-8414-902af86d924d", "comment": "Malware payload (Formbook)", "value": "4c73156035f06eefda603dd43365aff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658286, "uuid": "dcdcbb13-0785-4d79-b06d-d11671c61aa6", "comment": "Malware payload (Formbook)", "value": "96e8216c941bcea44a0c6d68019cec29c0bc8bf58cc8a20d61fbbf286c0f3ddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658286, "uuid": "d82deb47-bb22-4559-8aad-503f1a92b287", "comment": "Malware payload (Formbook)", "value": "8355e5bf72c715f683ef57265e739d1f6a382408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658286, "uuid": "115b83cd-c1dd-41ba-81d5-06d2aab0777c", "comment": "Malware payload (Formbook)", "value": "11ddc6fbfd22555150f806ed7ec41c363a7e69e49ca1b3c6cc072d42b993684a9da2bfd367d3ac68e52f9b97fd7c058c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658286, "uuid": "62b041f6-6f6f-4455-8f95-9c24995832f5", "value": "49F4121073889B96F67D4BB80468A21013F8F062E726DB0C7EDE615E5EB774787A0B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658286, "uuid": "db25d91b-cd4d-48ec-bf2d-ddfd2203810a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658286, "uuid": "f87c2e0a-a92a-4767-9aec-fe76457317dc", "value": "12288:z988SbgEGt12pj3HjZM4e/ZUdtbv1uF9TROnupV7i8iCBOlohZbG4K/yNzd+E+/s:aNeBUdt7gsncbB7xGWNk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658286, "uuid": "588a84d0-0307-4935-a30c-94a5167310b4", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658286, "uuid": "dc6c7a70-11d8-4948-a309-2d315df311b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658286, "uuid": "d3f59c10-723c-4984-beb9-a27c7852499a", "value": "4c73156035f06eefda603dd43365aff8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5a9848-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629451, "uuid": "e36331ce-b842-4650-b0e4-fcfc1332a424", "comment": "Malware payload (Gelsemium)", "value": "5d7cd888012605ddeab265865b7ba994", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629451, "uuid": "9f05abf9-b663-4c51-a492-93cfb2698fcd", "comment": "Malware payload (Gelsemium)", "value": "97982e098a4538d05e78c172c9bbc5b412754df86dc73e760004f0038ec928fb", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629451, "uuid": "d453e7ad-fc44-424f-954d-40bcb37f5b49", "comment": "Malware payload (Gelsemium)", "value": "88e4679e9a47a51bd82dc22460b5a69fd7d12acc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629451, "uuid": "e13baf48-89c2-4b4c-88f3-db51c97e28a8", "comment": "Malware payload (Gelsemium)", "value": "492bb8061ada81736c5472ccfc5118e1986012437f8014386a0319ea861cedf47f5e80f139dd0586733c1a5baf73b25c", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629451, "uuid": "f984cf57-27dd-4da2-8923-e2a02c45fa80", "value": "D8034B1B351A80B1DD8832706BF96FAAEBB959740E7341275384416DAF32750E523F1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629451, "uuid": "f04ced60-6a79-4414-aa10-2e988bc8f7ab", "value": "f0f848f1a87df044c3798c0763c13c1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629451, "uuid": "c7f21cd0-3cbf-463e-973f-c64701e847cb", "value": "768:xKwppU8SUGkaAtSECsS+4gsBeNFZq7bDW2IxH:zpDaZrHAFZq3DW2IxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629451, "uuid": "10c2ab9b-a359-4d57-8206-a8e9eaff5277", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629451, "uuid": "71156d45-de1e-4877-93f6-c2ae41636296", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629451, "uuid": "f0aa9f2f-6d55-4bcf-9629-511c73f184fb", "value": "97982e098a4538d05e78c172c9bbc5b412754df86dc73e760004f0038ec928fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8813aeea-ccd4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623649875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649875, "uuid": "8f28c580-83a4-4da2-a9d4-94207765a147", "comment": "Malware payload (RedLineStealer)", "value": "a8a893f9d048cfc5b51ee7f0832234f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649875, "uuid": "4bd229b3-91af-4626-acee-cdbf3891daf4", "comment": "Malware payload (RedLineStealer)", "value": "97be28d22f758b206925ddb8c1da20a3766d88b532c25c239bc67567d0a89497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649875, "uuid": "03a9c83f-20ea-4cd7-bc55-f2ff7e3228ee", "comment": "Malware payload (RedLineStealer)", "value": "4e83459da9fd2eb26cc58c18c6b55462ccff53e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649875, "uuid": "21041060-0532-4650-98dd-e027be15ae01", "comment": "Malware payload (RedLineStealer)", "value": "c5197bcd906a6faf0bb5865868cebe4156529f5793cd16d7f9ead9289cdbc7d1a610714e72f3113b953bcf44771ab05f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649875, "uuid": "2a46cbae-8918-41c8-8886-f01b9099ff1d", "value": "D5C42F2865BFC019C9A7EFB12DDC58BBD99A94A3A40E713311B0633B4B52794DE0F178", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649875, "uuid": "11fbbe63-ce6f-47d3-8526-35e43999ffe0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649875, "uuid": "635c6be6-8249-45ac-a274-e8f4268784ea", "value": "12288:BSoelzuXG25leeSh2L65qhqxD/FZp9tbrH5HZ/Dqdmz+I:gNRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623649875, "uuid": "a3b5f948-30c5-483c-b9a2-b9020639ee4a", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623649875, "uuid": "08c66726-eda4-42fa-bdad-84433a2a5393", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649875, "uuid": "1a19b5fd-cf3d-4899-9baf-6aa13f17cd5e", "value": "a8a893f9d048cfc5b51ee7f0832234f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea55727-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647175, "uuid": "3a61e2e9-2e66-4d58-95e5-414a5290be5b", "comment": "Malware payload (AgentTesla)", "value": "16dd94a96015805abc129d9a14f265f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647175, "uuid": "deb7c2a3-4128-4d91-be2b-62724600aa1c", "comment": "Malware payload (AgentTesla)", "value": "97ee8dab766bcacf5ed38cf3717191ff078759dde11e3f48702eb371c1533a2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647175, "uuid": "a45a3278-cf97-48b8-9c8e-44487f6c2767", "comment": "Malware payload (AgentTesla)", "value": "dcb0127c3f739ba41715b1a17a069a076e177fbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647175, "uuid": "91aa62bf-42d2-41f8-84aa-888f9c7c725f", "comment": "Malware payload (AgentTesla)", "value": "aa9510d76107a122f9528d0e7c82fe4c118173cf684753e43566f74ef3067758b4a79bbf7c9821f3f2ddb1b4a01bde40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647175, "uuid": "247f70eb-3b92-4ae0-8e70-fe8e127fde13", "value": "375533CBF122433D96E47C5476342313C5F295B9BEA78BF37D9C0A8139076896B6E40A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647175, "uuid": "861fcd43-dbdd-45fd-a57c-9a08fedfb6b7", "value": "24576:c2hEVY1CDElG5h5wyGTh2ng+YrB3D2p0+xwGA5vBL6YqWxXmF3t+DYzJ:4YEQ6nGTwnsNKp04bSE82eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647175, "uuid": "40cf9ad1-9f80-42d6-8f6d-2b878519e92c", "value": 1313361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647175, "uuid": "8a3a4da9-a97b-4780-90cc-3509f195d3f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647175, "uuid": "c19960e2-2d70-4469-8b26-67aa339d0ae0", "value": "LS0061321.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0172aa-cce6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623657612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657612, "uuid": "bb65de61-fa51-4c66-b404-4330d2aa1a08", "comment": "Malware payload (AgentTesla)", "value": "daba759df26122ceb6bc6b54be7877f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657612, "uuid": "dc58fec2-f4c4-4722-9b37-e40965715ce9", "comment": "Malware payload (AgentTesla)", "value": "9986013ec41e9df60a351748a1b3ccca171e50bf85b280b33b8b9b7c78c6e7e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657612, "uuid": "492b520b-cd22-4ef5-9aa7-fa13174f88ef", "comment": "Malware payload (AgentTesla)", "value": "8f1710b065b191aa6b353daa467fa89f7424300f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657612, "uuid": "82dc5146-3e11-43b1-bc07-e9ee3d386d79", "comment": "Malware payload (AgentTesla)", "value": "4af86bb5d5b10f1ddc19bc2fa8eb092e9b75fed30b9a07e8f8d23aa706e899ac3a391e84445352ed1b2f5e9290d8d5c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657612, "uuid": "3b38e72c-4382-41e6-8a0f-95e1226dd8f9", "value": "1515F12132982FA4D5BF6B3A4672810483FBB916E732D64C3F9D509D2B23F41DA72B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657612, "uuid": "4ce8313c-924d-466f-95c8-95b8a2e06394", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657612, "uuid": "5d223026-15aa-4d15-af4c-a5a3c87d16e2", "value": "24576:Kzs34iLh77rEaDAzJORjhWpybwWQopJ6ID//udkJsNeBUdt:x4AV3vDAlORwjWQa6ID/CwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623657612, "uuid": "1319c14e-cf9b-443b-ae4b-7d87520d5ce6", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623657612, "uuid": "a0cd1aab-be31-41b4-bb0c-32d7a6151f1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657612, "uuid": "21407653-2d1e-4b29-9924-03cd15bca56f", "value": "daba759df26122ceb6bc6b54be7877f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b835a8f4-cd2f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623689040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689040, "uuid": "0f797fef-7b6a-40ce-957c-a3bcdad1e783", "comment": "Malware payload", "value": "9925c832892716a17f2d2cfe504d6014", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689040, "uuid": "a18678db-8515-439f-a81d-34b2fd69f7da", "comment": "Malware payload", "value": "9a7b408de435746572b0dcb127b8e340fff5d91efb1d18cb054d51c9bd2c4a3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689040, "uuid": "6db6cf8c-6109-4301-85f3-1bf87e98bce9", "comment": "Malware payload", "value": "f5d62dc1cb878a0470565b2fc5370959689a63c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689040, "uuid": "94afffd0-35d9-4dac-8c2a-3dbf85d27680", "comment": "Malware payload", "value": "5c5bbf53047dc7972b99a2d9c7ee43bfd4df3c2e248e333b385d1a926aca47ab17739b64602c11fc5c2e3ba469c08a93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689040, "uuid": "7a2ab4af-4a0e-49b1-9531-1446688854c2", "value": "0554E0167FD84711E648247AC1EF012213E59FCB7EB2E3573F58329D59022A3BD4BA4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689040, "uuid": "8a068e6c-eaf8-493c-aed3-b1c2998ac5eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689040, "uuid": "9aba0697-f0b8-4cde-bc7e-98031675d33d", "value": "6144:TsGLt3tOl/EClorugoWcg2xhPyxVjkuWGnyu:TsGWE5SfryQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623689040, "uuid": "546e0e79-3448-454e-95d2-245001b76f3f", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623689040, "uuid": "f9fb8793-f3bb-4c05-ba05-5dbf7aa86cdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689040, "uuid": "622b90dd-9d46-4818-a377-d91bf68fb34d", "value": "9925c832892716a17f2d2cfe504d6014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0847103c-ccd2-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623648801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648801, "uuid": "94f9c2a5-9372-4047-bbf4-f0b7863974b8", "comment": "Malware payload (SnakeKeylogger)", "value": "54c36528b7b675b45f9184a2e7f22887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648801, "uuid": "426e5b50-e79f-4521-8d2f-331f2506d371", "comment": "Malware payload (SnakeKeylogger)", "value": "9aa9a4173ef2b801b8c0c5489756cbdcdb33eca2c6e07e66b889efce7e6e8590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648801, "uuid": "24ffb62e-2f3f-4c43-86cf-93be417cbe94", "comment": "Malware payload (SnakeKeylogger)", "value": "7f734a053249b2685961ad4ad0cb6a5be253679a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648801, "uuid": "4beefce5-c039-4ddf-a779-a760644a1355", "comment": "Malware payload (SnakeKeylogger)", "value": "e98554483f698ec78327c6402184b6abdf6ff7c642b916a0bd06961c0b00c17df16179d06273220ddfc1322359f3ff54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648801, "uuid": "9eb4bbae-b303-409b-a287-69ce8f71cff2", "value": "1BF4E1AD725076EEC86BD472CAA41C68EA643C77531B46079023319EAE3E987CF144F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648801, "uuid": "4f48fb0e-dd6e-458e-b04b-bdfa1c316dd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648801, "uuid": "1f7c7155-4fe6-4b35-859d-b965529875bf", "value": "12288:OZM4e/ZUdtbcb1FTpsZdjK0gHYuEbREF3JI8kPKLRsLAIN6k+V7gIAPtVSZ9dmRx:ONeBUdt21xW7jKHHwRC3JIDYy3N6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623648801, "uuid": "0954955b-7245-447b-a342-6b1797712a53", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623648801, "uuid": "71b726c3-513f-4807-8368-005c5023634e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648801, "uuid": "a7fe5f8c-b79b-4838-857c-f8ee67b673a8", "value": "SKMBT_C45121061216520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59320c62-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623658816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658816, "uuid": "62f3e6d1-a238-4b27-a070-e21d1360b2ef", "comment": "Malware payload (RemcosRAT)", "value": "f8bcccfceb623b43faeb2d7a2059edbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658816, "uuid": "57b92946-6394-4027-a3e8-31c469a568f1", "comment": "Malware payload (RemcosRAT)", "value": "9d54a7d0775a7a0e62f3db4a9af517a8253865c259f6a082a0a46046fde5624c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658816, "uuid": "024e59c7-959e-4420-9924-cf6927c989b9", "comment": "Malware payload (RemcosRAT)", "value": "955c52215d53708e753c5263f760b7c0c64f033e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658816, "uuid": "635f5329-7ce5-4bd9-93e1-5f81e5521c0f", "comment": "Malware payload (RemcosRAT)", "value": "95d8c7990404e9004ad3100a90ca53053d9e47c323d877b8ef9668467234bfce303acc1ddac0e3c5217bd003c0a8739a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658816, "uuid": "4603b345-5ff6-425c-aa5e-43b5c3aeb4a3", "value": "9D15F12232D86BA4D67E6B394672110093F7BA17D736C64D3FAD609D1B23F81CA72B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658816, "uuid": "f9058ae8-0980-4593-a49d-5419c043e454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658816, "uuid": "0278c116-4838-4d7e-b553-b7fba3e0cc73", "value": "12288:3EZVqePrGmUAAzYFWH20XfMrF060hhowsKoyl4bEqvK6xFZM4e/ZUdtb:31a6kWH2EfXw8oyybEqLxFNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658816, "uuid": "a3d07b07-4834-416d-acdc-62d21b290757", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658816, "uuid": "10ca9cc9-fca1-45b3-b75a-96b742458a4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658816, "uuid": "78b5ecc3-7fdb-407e-ab48-5a045fa8cd81", "value": "f8bcccfceb623b43faeb2d7a2059edbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a20d43a-ccfe-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623667756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667756, "uuid": "b0576e16-59a9-45e0-970d-ae1ea565efbf", "comment": "Malware payload (AgentTesla)", "value": "87458a056c5b7a3babc0b5b0d4664278", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667756, "uuid": "92b42130-75c5-41a4-9954-b46da4865378", "comment": "Malware payload (AgentTesla)", "value": "9e1c41de9e6909e96332fa6af01a17721cd82616aaa27a78338d0e305d58b81a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667756, "uuid": "25ff3b0c-87e3-431b-ab0e-c6be54eec734", "comment": "Malware payload (AgentTesla)", "value": "7e9848b1234fd4ba425edf10c86e4da5015721a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667756, "uuid": "8fad3034-d61a-44e4-bd80-af81c6ccda3b", "comment": "Malware payload (AgentTesla)", "value": "89d3d80c22e45197a2a1bb67fbe5549c60217858c4c5bc744be43210815b8d92136b63d6b0e55c209e372276310157ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667756, "uuid": "9e044b0d-7831-4120-ac49-0e44c7b7f7e1", "value": "908412959B1389B2C40A0D3BCC5B4C142EB7EF525837A99F758E331A7F3734E1A12A58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667756, "uuid": "142669f0-7830-482f-a2ce-e5a3862a87c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667756, "uuid": "89e4ec8f-fa4f-479a-967f-3a9000eff890", "value": "6144:l8mQUfIwzrr84ka1J6tUTI8GGgpx4mbA8gwfG8P8FPTcxEjjlcjI:l8rw44ka1XTZG5O0mwfGPJO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667756, "uuid": "228b92b0-7324-479b-bc05-2e4c3de420d9", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667756, "uuid": "ca11b022-6d98-4245-859a-b71b14b68482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667756, "uuid": "f3dca13e-6051-40b7-ab59-dc76c2e393e8", "value": "MV PETRA Vsl particulars.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e796c27-ccc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623644141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623644141, "uuid": "f56a43a7-3a66-4b6a-be3f-f76e7a9427f7", "comment": "Malware payload (Loki)", "value": "aebed0e9661761a676a6a23d8d9a1800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623644141, "uuid": "a05c5341-c9ec-490f-b6c5-d95169057387", "comment": "Malware payload (Loki)", "value": "9e5ab55eac6997a94e9f834793b82c1025924e5ff59645c23725639a8e7f1547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623644141, "uuid": "e34f4f09-13ec-445b-8500-06e93cfbd38d", "comment": "Malware payload (Loki)", "value": "caabd3bcf7d6801089ee0e9f3cbb1d2404d1619e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623644141, "uuid": "aa846581-6b36-486b-9d34-5c036b6297d1", "comment": "Malware payload (Loki)", "value": "6a656ea5ac26bf837208a34263c7c1edab82ad201d68c2c9d8064d1fcb4a467e892059680b83cd879296da37cc7f7578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623644141, "uuid": "98e1f51a-287a-402c-9687-d6dd09baba09", "value": "89F3026776C1C52BE08B9B761D73BBEBDBB797050536118B87600FA62A22183D4173CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623644141, "uuid": "2775e274-9d71-4ba1-a7d1-e93ecf4f6db6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623644141, "uuid": "ab7ce03e-1302-4545-89b3-a3c7167b2ed1", "value": "3072:DQIURTXJ+MbugojWpdxqL5P58fgSHP4a3N+42f84XggswTKK7p7t4qc:Ds9AjWpnc58gpag5rXggslkhON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623644141, "uuid": "159dc58b-fc91-44a4-be05-be02b22f94a7", "value": 165187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623644141, "uuid": "c9890603-ff8e-41b6-92b3-081f2a08c474", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623644141, "uuid": "6f71fc5f-094a-4c1d-8d7c-7a4a898fe5cd", "value": "payment swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4cb16b-cd60-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623710203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710203, "uuid": "4fc7abfa-2625-4b32-9ab4-199efb197f76", "comment": "Malware payload (RaccoonStealer)", "value": "21500b8f26a794e243db18e50b19604f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710203, "uuid": "eb0acd29-533b-4084-9bd1-76218bebda15", "comment": "Malware payload (RaccoonStealer)", "value": "9f502d67a0bf8c88a2569789a6ac21bd3bf80840b5eabcabffb6c493f7ba475e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710203, "uuid": "6527d5da-7a32-4e66-a8b1-7ae832b53713", "comment": "Malware payload (RaccoonStealer)", "value": "026efe006209bb1b0da8da054f0d3a6c3080eecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710203, "uuid": "7fc45d58-e808-40e5-9ac9-2fc18296e98f", "comment": "Malware payload (RaccoonStealer)", "value": "0a9b9f87fbeeaba91258113d572eb2f490df4de5c8d6ea3b4641dc79aba1f814dc5cd0c4d88855d6b6d3bc61d5be85da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710203, "uuid": "42e4a197-9e1a-416b-ad80-1f9c5f63fc7d", "value": "8426336037B284F6C6641B327F5E6FA1D66DDB7C06319CF7AB188B0EAEB4819C016507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710203, "uuid": "c7fb0a2c-fb78-4180-bee7-ed9d3beb0a94", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710203, "uuid": "39afa863-22d7-451e-a256-64a7065695ae", "value": "98304:xECvLUBsgUtB/0BW1jiGDDU1Eq8hlHefLFK1d/8J:xZLUCgQZ0U1jiG/U1Eq87efc1dUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623710203, "uuid": "04fa6da7-f379-4859-9370-f48207b212e8", "value": 4699090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623710203, "uuid": "3017be0e-d50a-40b9-bf16-8063088d0bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710203, "uuid": "176568fd-b28c-435e-a95b-04a852a59638", "value": "21500B8F26A794E243DB18E50B19604F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c259ed3-ccfe-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623667867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667867, "uuid": "a206c52f-9f50-4a2b-8c07-818d79bb1f71", "comment": "Malware payload (NanoCore)", "value": "d46a6d9505955c408cb5ed33141ef873", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667867, "uuid": "f46526a3-2920-4c6c-8d7e-01893e832e86", "comment": "Malware payload (NanoCore)", "value": "9f86835cf833e1f0a9d2d84e853241bd3db9a5aae9de834e114694517f922151", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667867, "uuid": "73e57a31-c1cb-4ec2-9c37-2df07d520cf1", "comment": "Malware payload (NanoCore)", "value": "b54bcbe1edb53eaacbc1eb73a832b2f325515f71", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667867, "uuid": "8985dd1f-b455-46ed-a7b5-84a836b36600", "comment": "Malware payload (NanoCore)", "value": "06ee0ae5edfe1e2a8d13ff7b74f9e17fae16c049b7e8dbfcdc5f1469e30d977614ac7f362f2c0abff105794afec6ac2e", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667867, "uuid": "9b5eb7a7-e444-4aa7-942a-e6220f38f496", "value": "BAE423C43DBB63A3539220F87B234E39985F648BB81245A1B469C3F6B111CF9C3A9F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667867, "uuid": "d64aa8a1-1284-49f2-a210-2a85225d9527", "value": "12288:Uc/gqNQKwqjK4SL+G+ydzj+W5Zl0GZD/1SLBS0ph0uYSolYdSf14pLcLYZEYWeqt:XonUI+GRVjFSFh0uYT+Sf+FEYWO7tW26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667867, "uuid": "9c92d5fc-97b4-40e7-85be-23daeac1210f", "value": 715348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667867, "uuid": "9df65e15-1726-4189-b03a-0b7b713b6307", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667867, "uuid": "148c6683-61bf-487f-813e-76bb2541597b", "value": "Product Listing pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5a02cd-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658873, "uuid": "6f8f5668-6e3e-4053-bae2-b81c625f5a19", "comment": "Malware payload", "value": "c9978eae0ae42d876fcf149f726ce914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658873, "uuid": "98abf694-152a-4e03-b970-534d7687b2eb", "comment": "Malware payload", "value": "9fb4d3ad8b81a240e66bb1d85651191f37e4bf02f9d0ae6542e102e2dbef1805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658873, "uuid": "45a847a4-1437-48ff-8cd1-4211f322546f", "comment": "Malware payload", "value": "0760dce624f4e5e6cd4ef63ceeb0d234ce5cb5d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658873, "uuid": "fa1f71a8-06ae-4e7f-9fc2-b1c6ee3b1c5e", "comment": "Malware payload", "value": "72dba8d16e01ac24913c67be1f72c4809cae37a14160e3dc2fbc60842a8f6ac6b8f4a56f39498249c9abd7a2b733fb69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658873, "uuid": "5dce7d62-0a58-42f6-9861-6d15e2136afc", "value": "4163202A7F448E80F76E2137C2CF111443F429961AF2E7277AA8326D45557B3BC4AD8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658873, "uuid": "d31635ee-0c0e-49c5-a8fd-98670464d8c7", "value": "1536:rtGmMaJOuHEQbE0Xf/MK0BeDCq+TqvR4uXD:rtGu7HEuE0XfHQq+qvRdXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658873, "uuid": "f1690210-96a3-4046-918c-d60df5f746ae", "value": 72070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658873, "uuid": "f46cc510-dc8a-490b-9b9a-7046904a43aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658873, "uuid": "2eb16944-c003-4c6b-9433-dbc5eea865b3", "value": "c9978eae0ae42d876fcf149f726ce914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3619b72-cd06-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623671476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671476, "uuid": "ae0437e7-fb88-4a20-91fe-0aacf17acb9d", "comment": "Malware payload (AgentTesla)", "value": "323f3479976711471dfe06afff9173dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671476, "uuid": "35788cad-c96c-4b42-bff8-16002d9cba5a", "comment": "Malware payload (AgentTesla)", "value": "a0f172b2ba3cfd17573361fef074e2b655aa87cc69eab2e026bbd027938236e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671476, "uuid": "8b6a7589-3f56-4b22-96e4-101db0c57f38", "comment": "Malware payload (AgentTesla)", "value": "dfefb4fa8d00a9bb46852800b46a7fa9e25e28fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671476, "uuid": "2a8d4b21-5162-4391-8d0b-a4c3937f7447", "comment": "Malware payload (AgentTesla)", "value": "52d88663de446ec45a8105713eae49456934101b5fec843ef27df4117665328694e814ede352c42f5c30eab6812dbf64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671476, "uuid": "be2c30f5-be4a-44d3-a3b7-67bbea501f88", "value": "3F05E02623C88B42E57E07389269419053F1BD1BD326EFDDBED910DD0AA5F81836379B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671476, "uuid": "4dcb9ff5-971d-4631-9363-83682ac37c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671476, "uuid": "edacbdd9-87e2-420e-a37b-68c80c3fcf7a", "value": "24576:KWeglTLM4ITdgma0RJROSj+54VsW/qk4Wm:DLR8dgmLWSjMk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671476, "uuid": "83f63faf-24da-436c-986f-969873136e83", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671476, "uuid": "422c5956-563b-449e-94f8-264c5123e1ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671476, "uuid": "b98cc84b-43ac-4dfb-93b4-aeb12ca5ccf8", "value": "PO#61420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6161eb-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1623658450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658450, "uuid": "58805940-257d-42c6-bd4e-e777b8820101", "comment": "Malware payload (TeamBot)", "value": "7e81a29ad5d5af08be59c951ece8870e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658450, "uuid": "061ad31b-f4e1-41b8-a85c-1ca552622778", "comment": "Malware payload (TeamBot)", "value": "a1296c1e2296049eb3a3dc3fcf174fe91471e0ec0a0c1a753d6103e7a070429f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658450, "uuid": "e2f97eb7-47f9-49fd-9b85-bc7c2b53fede", "comment": "Malware payload (TeamBot)", "value": "7bfb93cde4f9797848d011ce9fdd96f824d9b483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658450, "uuid": "32be5801-9ebe-4376-8856-e84cb4acb297", "comment": "Malware payload (TeamBot)", "value": "387549774e81e6b838587300689308dac5bc390c8cc39b714ddad34f7b152465a68414517c791cbf78f002ee68d75d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658450, "uuid": "9f62af2b-947a-46d6-8f4a-04e04a28b85e", "value": "8F050100A7A1C0F0F0F312F959799EA9A5AD7DB16BB9A0CF52D927EE16345D0AC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658450, "uuid": "d14b4390-67b6-4037-bc25-ab7e09a73c9e", "value": "baa7acc629fae892f4f615c8c37bd06b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658450, "uuid": "710fb0ab-3c45-4177-92bc-0f7796fd1694", "value": "24576:LnjRnLR/nocguO6peHnentsOrEX86u6K:Lnj/z5Z8nentsOH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658450, "uuid": "20d0166e-123f-4a09-845f-61b93e0943e9", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658450, "uuid": "f630124d-7c5d-4df6-a631-ade804ba537b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658450, "uuid": "11fd77d7-beb6-484b-9d88-5b2c46767c7a", "value": "7e81a29ad5d5af08be59c951ece8870e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241552ff-cd1d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623681060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681060, "uuid": "0ccae44d-faca-4c25-9399-1d7f2b0f9d16", "comment": "Malware payload (AgentTesla)", "value": "059e495c192b7316563ba630853991a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681060, "uuid": "a830aefb-ba00-487c-a378-1de5fa85d730", "comment": "Malware payload (AgentTesla)", "value": "a2aa1dbea5c0c514cce702916d2c0a3e18d76b13f2fbe3783a37a7617a088d78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681060, "uuid": "76696bed-f775-464f-a0bc-7ecebd154e02", "comment": "Malware payload (AgentTesla)", "value": "8505b422984f7b48b77fefc4fb97a17efe3b740f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681060, "uuid": "6a09ed38-a1a1-4d77-acca-b300b1c5af81", "comment": "Malware payload (AgentTesla)", "value": "5cdcb568ec915a6d95b750bd661d49f275deac5a681064865a8c4d121df0b32512fdf5406b1c464719319d0fab1908bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681060, "uuid": "31d5899d-3b93-4734-8319-8a673587f451", "value": "440507A8775455E1DE0719B2E7CB8D22423C1F7077269A0B4BA03F7A3D63E332935989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681060, "uuid": "4c605588-55fc-44fa-8a92-166b11c93711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681060, "uuid": "cb9d8324-5e5a-418c-bdfe-7a4ab80473c8", "value": "12288:81enoLLoS60/K7yh0C3rCdLtzu8usdegdAkcbZJg/e:8cnoLACbCXzu8u6DAkcbr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623681060, "uuid": "29b4a932-be60-449a-b6ce-f9f78f843022", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623681060, "uuid": "37250c9d-57e2-4b5a-8d84-ac15452f85a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681060, "uuid": "8e2e2248-76df-47c1-953c-1feacc83038d", "value": "bMovQzpzYUDTvQh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f690d75-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623651874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651874, "uuid": "8b562a45-6fc7-4170-afef-600b5aa68b17", "comment": "Malware payload (AgentTesla)", "value": "59d554039c9b99bf03face78299b94b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651874, "uuid": "c85172c2-7e1a-4c58-aa4b-08632db7da49", "comment": "Malware payload (AgentTesla)", "value": "a3a8df4eaad6b20c87a7aa91eb008f3a49945e3893078fd361ce47fce303429a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651874, "uuid": "b6630601-4160-4b5f-9371-8c38a1ed6ba6", "comment": "Malware payload (AgentTesla)", "value": "1d5384684489b69721ec4a41e55e02548e9f6aa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651874, "uuid": "1387ad4b-1829-4053-a90b-99f553d6034a", "comment": "Malware payload (AgentTesla)", "value": "7dd68419d4ec338bdf429bb020edcba3afcbbd26a6d9a3a8e19607ed473290705606c63311e9c039ed070b1512935c49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651874, "uuid": "bdefb69d-de27-4847-a417-3abf386f9565", "value": "B9815D3413385859CF5E95FFC0B0FE9E50D9B29F46E2A580B44CD9A507037660E4AC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651874, "uuid": "3a71c443-ff55-4466-9ebf-b466a333c5eb", "value": "48:3/06txDq4VVQZx/jRPI9nXKgiAQKD1jHnirGncQ+D1JjF5aedmDmQXmoWbD3ugw0:sIKZjRgJK/KDFOGncQoJXyRXqGCybxVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651874, "uuid": "fcc25bb6-0290-44df-9ce7-47006805a1bf", "value": 4121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651874, "uuid": "3b26ad36-c628-42eb-a40e-3f9f8039f6d4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651874, "uuid": "66562d35-78d2-4c4c-9112-a02111723096", "value": "RFQ Hyss 2021-Welded Pipes.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac00ac2a-cd39-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623693314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623693314, "uuid": "2b7362e4-5409-403d-a49e-83287e1e65de", "comment": "Malware payload", "value": "f23dd9acbf28f324b290b970fbc40b30", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623693314, "uuid": "efee357d-617d-4529-85e4-6eab99a2e7b1", "comment": "Malware payload", "value": "a3c020bf50d39a58f5345b671c43d790cba0e2a3f631c5182437976adf970633", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623693314, "uuid": "c1ccb1a0-d399-4de7-ae0b-53049da420ff", "comment": "Malware payload", "value": "fa2d17a1675ae8ea0c44a8a06376fe0c6267b7a5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623693314, "uuid": "d66123a6-db5c-4f9e-8344-0afb221e2f83", "comment": "Malware payload", "value": "10ee6bc22bb02fcf1bc4c1b6e794c643a63104c031d2653006f09f17e8421f8c25791404cce6a199077cbab415b0d72d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623693314, "uuid": "68a34d89-404d-4766-be82-64756d8c99ae", "value": "9B659B09F4B06079EA4A423F20BC865F2B3E565F7126553EB3FAF3506F016BBE648854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623693314, "uuid": "82a3deb0-01e0-4bbc-a2c3-e17114834911", "value": "6144:Vf1cbwPwse8axEtjPOtioVjDGUU1qfDlavx+W2QnAkSsRa:XccPwsLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623693314, "uuid": "58603fe8-9d49-4fe1-b616-01d97000113b", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623693314, "uuid": "9baf31ee-d7f7-467b-b236-04ef4005e1cf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623693314, "uuid": "a6f40a91-7354-4e97-98b3-5b8a3ba68858", "value": "a3c020bf50d39a58f5345b671c43d790cba0e2a3f631c5182437976adf970633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f4f66b-cd17-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623678587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678587, "uuid": "55e05e1b-1bd9-4b64-949c-2cbdca6cd5e1", "comment": "Malware payload (SnakeKeylogger)", "value": "be48f0d6db9b593655735e3b1203e189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678587, "uuid": "200fd875-4a9d-4a0f-8543-27c1b16785a4", "comment": "Malware payload (SnakeKeylogger)", "value": "a3ca7c4385206990d3927c273f08e4daea47887567774da579337e0966593ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678587, "uuid": "4a140712-3305-443d-8030-667366f5f882", "comment": "Malware payload (SnakeKeylogger)", "value": "1245e89669ecbfa24e33cdc9c2064003836868c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678587, "uuid": "56198423-6cff-48df-864d-4df964f9048c", "comment": "Malware payload (SnakeKeylogger)", "value": "c8c3d25c46a7242ae37fc92d4a30156d01fe76a16025fb86ad4002102ac3317b4de4e0a191d4de66e9af3b46703e91fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678587, "uuid": "4ba5914f-d4d4-4748-9ac3-4a3729d46b96", "value": "63C3191C3BF89C04E6FF8A3705B25120C779B8811A6BCE1D0BD2F469197DA919D1AF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678587, "uuid": "ef7b27a0-df8e-4aa8-8de9-99cdf72addbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678587, "uuid": "181459b9-f2d3-4dbd-8efc-69f83e73f979", "value": "3072:JaV60/pYor2W1iDJE9b++rEtZ7bSgxwBeS/:Wx1i9E96JZ7bDTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623678587, "uuid": "be84e02c-df0a-44ac-abcd-f66841f039d8", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623678587, "uuid": "554d3c9f-7ad5-49e7-ae19-625bacc41aed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678587, "uuid": "631d5f2e-8a11-4113-bc96-f1f720d21f78", "value": "StubV4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fd62d5-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652398, "uuid": "51533f84-67a7-4500-b34b-2684650c89f3", "comment": "Malware payload (Mirai)", "value": "1735e9c25207589a6f67b7e9aa9f3b34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652398, "uuid": "6bcb9cc2-89b0-4957-8b4d-5d6caf76a2cc", "comment": "Malware payload (Mirai)", "value": "a400ab201f38d7244c6f02ac3c2929763e2821b7a405617f46aa57badf262a4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652398, "uuid": "56528918-19c9-4389-bea6-05ef79927643", "comment": "Malware payload (Mirai)", "value": "dc229a5c1090ba6749d3c8eda8178af082b7524a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652398, "uuid": "8fd10fc7-08e1-4439-9525-de021c6fd81e", "comment": "Malware payload (Mirai)", "value": "966dbd8a8483fae0101aeb89a236839cd0a43787ce7bbc7e4ac36e10da8a90b1bfee4044f053b662aef6edf95557b6dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652398, "uuid": "b8d239e9-1a2a-4f2a-800b-e26868cc5dfc", "value": "C304E744EE44872BC2D377BEEB5D028E3B391FA477EB36111A34397427E5B642A3A150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652398, "uuid": "43be0371-0d92-4597-aa66-cd95f989f3c0", "value": "3072:5et4bJRTOJzWK9l7abbITvzMwx3Xx5Sc7QNO0Z0YmN0+7Qgvymi/WkK:5i1JzXHwbIzowx3Xk+YmN0+7Qgvymi/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652398, "uuid": "9edaf3fd-ed20-4856-b059-45a71992e91e", "value": 181108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652398, "uuid": "65f34cb9-3c62-490b-b992-400858ebdc9f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652398, "uuid": "edb2a73d-7616-4db0-8967-9158e06817f7", "value": "1735e9c25207589a6f67b7e9aa9f3b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01879a4-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623653861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653861, "uuid": "fe49b81a-56c4-441f-af89-8d5fe78e508f", "comment": "Malware payload (Formbook)", "value": "178c08e1ca8b4df2c676430ff545b107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653861, "uuid": "0db71be2-fc55-41d2-b735-966a82d14a55", "comment": "Malware payload (Formbook)", "value": "a47054787772fce1a96257aa9f1a70356fb752ba73ee714beed7826796db3a13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653861, "uuid": "c243b52f-6d20-41c7-882b-721264da7fd7", "comment": "Malware payload (Formbook)", "value": "19973c48b9309ff89f125c20d0e708a29b42ee30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653861, "uuid": "badac24e-e85c-48dc-a955-7c048b2cdd67", "comment": "Malware payload (Formbook)", "value": "fc7ba610c9b210bddd118d80efcbbdcaa1445e79c985e4f17d93c8f64ca785bd47098685ad6d1857a5fc608d24a86044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653861, "uuid": "aadd7a74-d2b3-4840-8115-f23010210e90", "value": "C524121B73D5A8E7EB5A16B1593BC61DF6FFC3162BA1521B2B700F751520183CAA23C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653861, "uuid": "2a9de620-7987-4c26-ae71-a6e0cf4a680c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653861, "uuid": "5c93fd76-f062-4a47-b8d5-f9d91d4d0871", "value": "3072:8Lk395hYXJvMoxG4E6kzmMr0gtbn77zFloNXVkiTXCovlmpmhapDYdW2ryWRY4o/:8Qq+oxRshPzboNXfyothm0dWAWKYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653861, "uuid": "9a783068-d987-48e3-9174-f1441eacd7b7", "value": 218403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653861, "uuid": "891667b5-9b07-4b69-869a-dd279e759c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653861, "uuid": "5d9a0b2c-5ee8-4ae4-b101-449a55072870", "value": "Wire_receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f559ce0e-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623652206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652206, "uuid": "55896385-02f8-42f3-9d9d-21680e152ec4", "comment": "Malware payload (SnakeKeylogger)", "value": "ce6fb2bc2ee18190388ee8b24d8cf874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652206, "uuid": "e58fa008-2fac-42cd-9790-4739ef05d11e", "comment": "Malware payload (SnakeKeylogger)", "value": "a66140f8821b3102cfcee3b4f76a9676ca071985a88e66b535434c60143c3c0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652206, "uuid": "6b9fbc45-dd47-4497-ad07-b769d3e27bd7", "comment": "Malware payload (SnakeKeylogger)", "value": "046d2e41481e3ed630d46c2ea0f1cff65c2c646b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652206, "uuid": "b5599528-1327-4278-aaa5-1e08ae46bec3", "comment": "Malware payload (SnakeKeylogger)", "value": "d53d68d8ac9da1e849d92b2e903f804a24bfff9ac9fd7ca4027a2418e60c872c12180bd8a9cac40d5e015fba7d56164c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652206, "uuid": "1bfff4d0-f419-4f36-b1d0-61ce27d65329", "value": "F5F448032ED4DA8EF1D54A7E05FC50627FA3D882181E9FC768CB77AE14E1946F620A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652206, "uuid": "dd21afd8-4ade-4353-8116-9c9ca352c60d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652206, "uuid": "c48b1cc4-0f69-4ae7-b958-46c0ee71f9c0", "value": "12288:Jm1et5UVYtXiZrM+DuE1/p8hFFxM7tithAlLSntB4YseEiH7yK4m3Jq:zvUVYtXiZrM+6Wp8hFM7YrAUtBzDyK41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652206, "uuid": "74d7a9bc-c204-4ba8-b9f0-3af84b340bbe", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652206, "uuid": "6b114066-cff0-4fec-b1a6-7d29bf51e36f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652206, "uuid": "eca0cb20-f87c-4bae-8a06-8351e196f757", "value": "AWB#DHL119040,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c470c898-cd1d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623681329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681329, "uuid": "5d9a12f0-7a9b-43c7-93da-12f08ebfd6e1", "comment": "Malware payload", "value": "4b431afdb3b9197fd3e998e6354d5392", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681329, "uuid": "65281730-040d-4d27-9eeb-5c3a5c54a319", "comment": "Malware payload", "value": "a83fc1372384a42b479adbba691e5de280f53df2045b1b7246d05f6003dac8af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681329, "uuid": "228f7c51-db92-4ca8-a6cf-d79f990c7cde", "comment": "Malware payload", "value": "8ba4bcc6e75a19df5557e91fe232318a267caf4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681329, "uuid": "51a9e88e-67bf-4e09-9aec-c1ce87176950", "comment": "Malware payload", "value": "0935ea0efe6923549253452fb9b050f9760d752e071ffbbd7674f7b9f86d6d7cf18af3b85f11dac833ce66fb74554c5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681329, "uuid": "61bd6c05-b762-4ef4-b976-882daf73fe33", "value": "2F25CF134ECF866AD2A44DB66B71EC8781325CAA2548B3223EC035BDD9371EDD8EF511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681329, "uuid": "419b6d97-3fb1-47ae-bd08-aebdf07d6ba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681329, "uuid": "d91508ea-fd1c-47a3-87e9-5f83acefab2c", "value": "12288:J2SMPQipP5YZ5ltPapFYaPtfA6TdRT/0pOQ+wsU+Rjv0vnyXEU2WX9tmy:JJipO5XS8oA65R6X+ZJrXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623681329, "uuid": "58b08740-b2a1-4562-ac5f-1d857007731d", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623681329, "uuid": "8558698a-800c-4324-822e-fc503549c028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681329, "uuid": "8c874bcc-768a-4258-9195-107bcd1afebb", "value": "ZNJtJmJ32owNEP5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7ec7d4-ccdc-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623653129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653129, "uuid": "e8c012c3-10fd-4cf7-ad04-1241d9e3702c", "comment": "Malware payload (SnakeKeylogger)", "value": "277ed76213cd7835c412929b0f08ed2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653129, "uuid": "ac911f57-334c-438a-9f37-02231f95cac3", "comment": "Malware payload (SnakeKeylogger)", "value": "a8640ce0298fa73136029c721dfdeee551b637efcf4cd4233d414c031fb65ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653129, "uuid": "0eb23677-8ce9-4c05-8bec-ebc57a1afddf", "comment": "Malware payload (SnakeKeylogger)", "value": "6459c8ea2d602516faf901d492d799a72351f213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653129, "uuid": "b6434f8f-c912-4522-91b0-a42d0dbcd2a8", "comment": "Malware payload (SnakeKeylogger)", "value": "36ea8e139c2fcb5dc125df9eb1784709438cf3cf1286477f67f2d9419184b880688a3bcd2173d919f12806dcad0711bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653129, "uuid": "4cb3801a-1e95-4245-a782-bab6ac617305", "value": "D335F13232856BAAE539B3B95011401297F1ED0BE355C65E7EE9F2DF1839E018372B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653129, "uuid": "8d711fde-2500-46b4-bf20-246f49a6e55e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653129, "uuid": "74986733-8d7a-41a1-9a29-f6d3f6661079", "value": "24576:+5t9UNUVYtXiZbQjZQykOXc09l5HjruU+FX8xfIDRZ6RjFBUDCDjQL:fUYtXiZMW09Du/FX8uv6pFqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653129, "uuid": "cd711edd-a8c6-4fe6-bff9-a5f1addb7931", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653129, "uuid": "4763fcd7-4e85-4a86-a70d-178f01054c31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653129, "uuid": "7af3c6bf-e8d0-4f51-84f8-141b7bf98788", "value": "Doc_6_07_2020-213.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d6f088-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1623629443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629443, "uuid": "63c09925-ac8f-42f6-b57b-d6a2b4a8e4cc", "comment": "Malware payload (Pony)", "value": "64c47fa7734a4d9554009f92bfda0b43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629443, "uuid": "3da931e8-761f-4561-8858-e0ee98e2d7ff", "comment": "Malware payload (Pony)", "value": "a86978784d7010ead01a68d2ac9c10607d9b2ad7fd2881721eba2c4ce06ae381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629443, "uuid": "539f7e51-7e1b-499b-b605-7d460b939c30", "comment": "Malware payload (Pony)", "value": "e8a989cbf8876367e57098ef91d5bbae54d59e80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629443, "uuid": "e28e66d8-a3c3-445b-8d05-ff8a1ac1070e", "comment": "Malware payload (Pony)", "value": "d9a24f3a369e7b289746e4ab2bb65c7603b3b3852bfbe300512c9020329dafade4a7c92e1ee22061620af6fccad61227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629443, "uuid": "c3585535-5806-4c72-ba22-fa1ed7b9e4b1", "value": "BD340185B3C0C897E1556632C8AB6B72C2F1D905812276971B183F6FED22273D9B6F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629443, "uuid": "63264947-456d-428b-a8d6-139983457511", "value": "e990dd07e89d04c53e337ab9b3f5e0cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629443, "uuid": "41a9d1ac-0e9a-4dab-aba8-950f341ffa26", "value": "6144:e2YnYaY9bgKWf+VVhVYD2lIskjNXa//JZVggD1s53E69Y:gZesfghp9kjNXaXJTZi50uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629443, "uuid": "326aece9-f979-410b-a2a1-8ca71d00e42e", "value": 232906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629443, "uuid": "5c25ad39-6df8-4e59-8fe6-da8d16bb5acf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629443, "uuid": "7442eb83-7ddf-4862-84b3-8f2fd62bb9e9", "value": "A86978784D7010EAD01A68D2AC9C10607D9B2AD7FD288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dd22c6-cd60-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623710029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710029, "uuid": "bea7cbbb-3cb9-4e28-a874-dbd7c1914b68", "comment": "Malware payload", "value": "ab95d078a29cdd0ba060b4ec17d632d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710029, "uuid": "857f922f-bb69-492f-a1f1-20430a329ff4", "comment": "Malware payload", "value": "a8f08798d07631c972e1d31bd0c696859d060fdce618eb3fc0c214b94038767b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710029, "uuid": "3f8a1bef-41de-4ae4-beea-a43a57fabf4a", "comment": "Malware payload", "value": "cfd3740eaf17aacd4506c7d0cb8bfdf02495ed06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710029, "uuid": "55c2e142-ce02-4b73-8115-f79d136b26ae", "comment": "Malware payload", "value": "5470f14a67440f6d3d6b1120e8e278b4ce76a9247a9c2874ff47dc9b8ba3989f6710120c35b31510a06260539e02af4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710029, "uuid": "3c85c20e-663f-4ca6-ade1-bc3ed5e9a38e", "value": "6A45F004E253A361C09BF3FE251DF27444294E3F0791A6C37778FED699E8E8896242B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710029, "uuid": "7982aa31-1096-4116-9eab-a3442e13e4a3", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710029, "uuid": "903242b0-8e77-43b9-a989-6ad232562d85", "value": "24576:t9btxEOfNMkNAPo5yF43jxfZDCzcpQ7JdwaZ1UaOCeoBrwwztq:tNNfakNAI5xxD7p0Q2swQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623710029, "uuid": "21692842-c4ba-4b64-9c39-2d30bc4777d2", "value": 1233097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623710029, "uuid": "5664f9ae-101d-426a-a47d-4745274e6f00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710029, "uuid": "faff14f9-12e2-45e6-ab06-8d126a63f256", "value": "ab95d078a29cdd0ba060b4ec17d632d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff36c10-cce0-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623654881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654881, "uuid": "d61f1cea-2e77-4b0f-9417-0450aa304c85", "comment": "Malware payload (AsyncRAT)", "value": "1eab9e88e91c80d568d1bc11f6ea7595", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654881, "uuid": "a8f2fe87-bbab-4c56-ab69-382e988271f4", "comment": "Malware payload (AsyncRAT)", "value": "aa5834a0ebe6dd2adab2f930e8f4e8c50aa18eab4cf3f7cc28a038fc344b72e2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654881, "uuid": "2348a7fc-03b4-49d4-8565-e6aa3892ff77", "comment": "Malware payload (AsyncRAT)", "value": "e3b45fd3b83f3954c429e9eeb663612ddb28946f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654881, "uuid": "e8a0a1d8-9574-401d-a0b1-720bc5eb7117", "comment": "Malware payload (AsyncRAT)", "value": "77dae45c00c45a024571a3003ec600d0a6690b98553181328ddd23b1d0773f2ef81aebcc15156abf2f3be2f3b685edde", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654881, "uuid": "e50d2fab-af10-4677-99fe-05a04099d970", "value": "76A5FB5583D062CD77B62BC48FC185DD9E5BEDE00A3B55A70129128783728C3ABB2F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654881, "uuid": "258d6fff-fce4-47f2-9dbc-fa27b745c3e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654881, "uuid": "f48f3d10-0693-4ae4-8099-a3bc2e82f46b", "value": "1536:8WqTyxLj2Fmmhhmmgzme7DwQDvmjDwQVmImmml6mmm/mmmKmmmXmY2emmcmmjmmG:7q2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654881, "uuid": "f4a3d336-71ee-464b-924b-5f5c2c5f136e", "value": 2243584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654881, "uuid": "a863306e-5ef2-4fbf-aa2a-32923a42027c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654881, "uuid": "90e4293f-99dd-433f-bc47-d90362a2e73d", "value": "IMG_Giris emri 20201122164730_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5011a3ad-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652358, "uuid": "f083416f-28a0-4ea2-ac63-9928a8432cb9", "comment": "Malware payload (Mirai)", "value": "deee3cec5b8f1534687e1edffbd20d55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652358, "uuid": "33ef7224-6c08-41da-9694-408f8379a4b6", "comment": "Malware payload (Mirai)", "value": "aa695ed0cdd93391ab302c15599b4f5b1b1e1bb92ce597033b6219fa695a9281", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652358, "uuid": "4ee26c0f-0804-44fd-920c-37a66a7d6d42", "comment": "Malware payload (Mirai)", "value": "da388d0972f7964d0b48e9a62ffa63c71eeaa0a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652358, "uuid": "a0956b9c-97b3-4146-8b05-1a51d64d4c0f", "comment": "Malware payload (Mirai)", "value": "ae17c137e7ce6e35d47f249fa92615c235d8bfdbd1c5befebcffa17f4bb11853f6f60c3b49d36a195c5d6e1c4a8fdcd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652358, "uuid": "a8895894-a07b-4cff-aa50-afc463a82174", "value": "75D33A457B44C0B3C14311F912978F665432FE3A2686995AF3A83CB8FB39185B631FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652358, "uuid": "bb734d81-93ca-4efc-ba37-c8e9dce1f9d3", "value": "3072:Q6LRb5MLrGUZUOcfGAo55xTrYzF3z5DFgTWmDmq0ich2yeaK0FU:Q6LRJAbcfziXaLDFgnmq0ich2yeaK0FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652358, "uuid": "a06f1a8d-b118-42f5-aae1-9db4c4f5fcb9", "value": 137632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652358, "uuid": "88a0a54a-2627-430d-95b6-ba9e145210a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652358, "uuid": "70e70fab-5703-4c6a-b7d0-f790e87ecd8a", "value": "deee3cec5b8f1534687e1edffbd20d55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a756d5-ccdc-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623653280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653280, "uuid": "d2012876-c79a-4a1f-8d4d-efc09706ea14", "comment": "Malware payload (GuLoader)", "value": "db7cc0b29cf38b5ed2a176c0043b2a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653280, "uuid": "fb84a147-494e-443f-8516-07a85bb74ec9", "comment": "Malware payload (GuLoader)", "value": "aa70c51a1df950f7b8406f4599a7e3bb89bc61fec570fc0e3a53826d42cbf13c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653280, "uuid": "80babf0a-d9c9-4a80-8fc8-0ae9c1c0b43f", "comment": "Malware payload (GuLoader)", "value": "8e5c1a3ca8e4b5cd7c43cd7f0acbc40a09cefbef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653280, "uuid": "9d11c558-f210-4710-8280-3d37195a1b1a", "comment": "Malware payload (GuLoader)", "value": "748de3d6b5f081687e84194cf95334f309f53fac7708360cc3984d940b73c8d27e1a9a803fef7e7535ebda7c61c917b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653280, "uuid": "eb85da0d-857f-4304-b156-6652e3aa2b3c", "value": "6A547272F356FF29E45680B0E516C4B5903FB4727709642B93833A65F0BCF50AA36B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653280, "uuid": "1a58c035-dcfd-4103-8d51-cbbedda9ab2a", "value": "fd5523c2b03dc52202311eff5bcab494", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653280, "uuid": "1f633b16-e76c-49d2-927d-d292c7777f69", "value": "3072:VO64I415+Uznrw1JmTgxViFJqryHbQbZ:Q64I4HHz0oym7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653280, "uuid": "0b42d62f-ea5b-4d08-9f5e-d86aba954fc4", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653280, "uuid": "411d94a5-b88d-48cd-b0ee-d21adc8bc136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653280, "uuid": "62860173-86be-4408-9645-b1a53439cb1c", "value": "Order-078CNLTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2440c485-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623647130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647130, "uuid": "4c530f94-d61c-4357-b415-36916a6567a0", "comment": "Malware payload (Formbook)", "value": "1548341a7cc3fc75280201977c74bce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647130, "uuid": "9e2bf178-b458-41d7-9410-29c057400243", "comment": "Malware payload (Formbook)", "value": "aab01704c3cce6d9a75418e3ba4a905ebe215eed1d8d010096638b7f849a4f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647130, "uuid": "6200716b-1852-4077-8f11-530b91f6aa6d", "comment": "Malware payload (Formbook)", "value": "a27fb33c834126735ca3cc51d68392231791e7ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647130, "uuid": "eac65826-0fb2-4577-a610-a1b8c636d080", "comment": "Malware payload (Formbook)", "value": "15ea7a43d98307f5172616072ddeb016bde43725b537ead4b433c846c61a2c26956d8d5a0c5c480777ed49e581a1efdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647130, "uuid": "34771183-07d7-45e2-93e6-99564a576ac2", "value": "ADF2D4196BE84723C5A807F958A1981043B7AF2A5462DF1C1FCD70FE5972B034FA2B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647130, "uuid": "0b6d2ff2-0cb2-4b77-a75f-cf5d7e346f69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647130, "uuid": "c033a834-a79b-4cdc-9493-7b19cd663f89", "value": "768:X11SE3kR/JTpOQ0YlOfi3XdLmWWuWfv7Qo1VRATbyKm:lUJmzuWLQo1VRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647130, "uuid": "a79c95f1-944b-4ff4-877f-cabf214901a8", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647130, "uuid": "6f6adfaa-ec9c-4195-ae4f-7930f8f15058", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647130, "uuid": "14c38c3c-3fa0-47c9-8c65-3ac1e20775b9", "value": "Spec Design.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c546c5ce-ccc5-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623643535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643535, "uuid": "37324434-b833-47cd-8c93-9bcfaa9851a5", "comment": "Malware payload (Loki)", "value": "3c1cd1f38ab862256d4c8c840fc0e323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643535, "uuid": "2f80b69e-75fc-44f7-9b5d-58e0aae0e1c9", "comment": "Malware payload (Loki)", "value": "aafe476ad4349ad6562cb96d59591b078f12cbdc559915351e2fae27725ff742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643535, "uuid": "385e1e6b-ca0e-4129-b8ed-1d01efb47476", "comment": "Malware payload (Loki)", "value": "4296171ab4dd8eb89476f8220b12b94f68e5aa2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643535, "uuid": "627a8f4a-2a10-4be0-ac77-381356633f0b", "comment": "Malware payload (Loki)", "value": "4a4f55e86ce3914a1bd19ec8952d63f59ac0928b844dd6436973bedbfd8ed91d964e268f532eb8cfda54f65e2991a60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643535, "uuid": "c36ab7df-c889-4ee4-8ae9-617188ab6c74", "value": "29D42314A3A14F2AC1BD27B84270484187BCBD54123DCB0C1ECA74EA7A77B724B85B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643535, "uuid": "0636fc5e-92b9-498a-8aeb-7db54a34dc30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643535, "uuid": "ef25d9c4-5036-4d52-97b4-8e7a0229cc3c", "value": "12288:22EZM4e/ZUdtbXzVuv+l+8fS3/dp/xZ4GGz9LFgcB:22ENeBUdtjplfQV9XjGRxgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623643535, "uuid": "c56e1a7d-0e5f-4032-84ad-b6bf9a5f9b6c", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623643535, "uuid": "85f353e4-2cc5-4050-8830-dc7725b7a48b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643535, "uuid": "e26b56e9-40e6-45f9-a44f-ad62f88284bf", "value": "cenQbJW9WbUD0J5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16058120-cd2f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623688768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623688768, "uuid": "265450e1-9354-456f-8df9-3710724bf578", "comment": "Malware payload", "value": "ba4fbe0a009c80aacfc63d729a62e8d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623688768, "uuid": "e690786e-772f-4dfc-84f7-fbf1e327bcc8", "comment": "Malware payload", "value": "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623688768, "uuid": "ead9b599-6eec-4bdd-931c-b2dfd8236c1c", "comment": "Malware payload", "value": "4bcfd4267b39231bd365859e099ae7fc65145372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623688768, "uuid": "4268452a-ac2d-48e4-9785-17e61a735dc4", "comment": "Malware payload", "value": "f25a69b05c3d08a457c8db7afc479b560b778032c999848af651ff0e18b288ab4d95be5d535500033e249e103cf347e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623688768, "uuid": "f6abf1b9-a080-4344-b0dc-ac34337e8b1a", "value": "8181328FE57168B2C1B407FE892389C9A17A3B704A250AEC04FFB8196D5E357350D58F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623688768, "uuid": "a917adf3-8fbf-486f-be21-f36d4cbfdd6c", "value": "9eb38642d795cd7c1e2ce5909c1a70fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623688768, "uuid": "d48a81c6-6e0f-4057-b67c-e432b14349de", "value": "48:6OgYenC35lwKrIcOqltfikOx9UBe6Ci8NoVcPhZhsTVnz4TlCc:I3er3fsUBe6CFa/nzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623688768, "uuid": "ca7cdf75-b86c-4d89-a3bf-2a82b184a5e5", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623688768, "uuid": "079edc16-b2b0-46c6-8744-accfc346d004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623688768, "uuid": "2c0c4ded-1062-4237-95ae-8e768333caec", "value": "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2136ba8b-ccd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623650991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650991, "uuid": "fbdd950f-ef85-4e5d-a29f-963487bf7d40", "comment": "Malware payload (Loki)", "value": "0db8ef26319391f0d3d5ad1fdb86870d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650991, "uuid": "3ae5eea9-dd29-4af4-9c07-53c37d483752", "comment": "Malware payload (Loki)", "value": "ac1f8df93b24998bc50b37bfaebb261a9b8db81622872bb2280011bbbbbf898d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650991, "uuid": "2f70db45-2845-41d9-849d-430f748da734", "comment": "Malware payload (Loki)", "value": "be78cac11916c37e16b0abdbcc83ca71a9aedd16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650991, "uuid": "68ce69e1-7855-44c0-ba24-1b8ded6bbbcd", "comment": "Malware payload (Loki)", "value": "48b5790f74fa0c8680209fe53b76f106839e44d232011c34dc37b7e872b2938d15bd8256bfa3243bbd2b8ed0321de396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650991, "uuid": "c4c4bb74-36d3-4f53-b418-c874a8d03b80", "value": "DED48D52A8034964F3405CFA24B040B6AA7D9CC7D6AE1E77A41DBB3634B3ED0728F579", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650991, "uuid": "4f307454-3abc-42e4-ac93-857c0083a64f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650991, "uuid": "81bc87ce-68e0-4027-9e43-04952539863b", "value": "6144:nOf4KHXqi5zxhQmdpDaeRS/8m4v4gCixH4PLOkWXPguFS0WdEpfEg88:1q8mdpDVRcPU4LeSSkULSCfnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650991, "uuid": "83f076b2-4494-4eb0-8de1-822550f1cadb", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650991, "uuid": "b60daccb-cd16-4a35-a9ba-c93b00b375a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650991, "uuid": "26b7e806-c400-4910-a6c8-55345428fc9d", "value": "MV.RED SAKER - S21173.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aba7454-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623654496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654496, "uuid": "1e89b027-e577-4b4e-a613-c285bc61c5d2", "comment": "Malware payload (AgentTesla)", "value": "bf925c5e020c6ea955d5e7d1d6165631", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654496, "uuid": "523ccef7-8f2b-4008-834a-5a4abbe47411", "comment": "Malware payload (AgentTesla)", "value": "ad52889353d4df1aa9bbeebda2e18541a574a69cd4cb48b284ba62ccc21db7f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654496, "uuid": "0d36b1c6-147e-4986-bc94-a3035b2d7f86", "comment": "Malware payload (AgentTesla)", "value": "71495866a62fc4f1b6e48c1dc6ec674744e745ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654496, "uuid": "397af9b5-e645-4b44-823b-3cc5928be5c5", "comment": "Malware payload (AgentTesla)", "value": "a25309eb117327b09a2344bcce487bddb92df887a1c8b3f180b0d45e4439cbdcced5397a30705bc2c95a5c112cebdcb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654496, "uuid": "d5790d90-d07d-4c0b-b133-05e8db802830", "value": "6105E06236882BA4D5BE6B398632520043F7F926E735D65D7F9D109D1B33F81CA72B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654496, "uuid": "2c967abf-93c9-4e88-aedd-1f0ebf20d4c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654496, "uuid": "588dfba4-3d7e-4260-825b-ae469e9e2132", "value": "24576:5+Soho1rF434ySWbd6lXtzYjVQ7NeBUdt:/43lp6lX8GwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654496, "uuid": "7a87bca9-e2b7-4de5-95bb-56efa5d64881", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654496, "uuid": "b70e8fae-2d6a-4f8e-9638-a86b6d1f70d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654496, "uuid": "82e2d525-61d7-4f02-b162-36779a3795bc", "value": "bf925c5e020c6ea955d5e7d1d6165631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283a4a29-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623654438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654438, "uuid": "4f0d6c49-ff59-433e-abed-d619cbd5e0be", "comment": "Malware payload (NanoCore)", "value": "68dbdf591963e7ed392894dc483a98b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654438, "uuid": "a755a8bf-48dc-4a33-9d77-208d29d7c806", "comment": "Malware payload (NanoCore)", "value": "addb90095a3adafbc550678b46d05e114665e4f6801a189e5cd705cc64152acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654438, "uuid": "6d9d81f7-85ec-40a9-abf5-230275781c15", "comment": "Malware payload (NanoCore)", "value": "81e16d8a88a3cb8cd81e40247e146da0d97b85df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654438, "uuid": "db00e9ed-1283-41f4-8767-60ab7f9b9767", "comment": "Malware payload (NanoCore)", "value": "2f43512ada506e2c8cd5a7f3d02206bd28d08ea6f99542080dfeb01fe27900396e3ad2c137941ef9c0a8d37ee8327258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654438, "uuid": "74e64470-3f46-4c85-b869-b3b0bce065ec", "value": "AB255DE6BDC4D8A9E0C9CB3D82FC5866BF53C5EA010B4ED905D6B79C068374AFB58442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654438, "uuid": "7defb366-e15c-4f60-84aa-27cfee5ebf2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654438, "uuid": "0699c18a-3cd6-47a8-ad42-fceeed704eed", "value": "12288:Xfc53Inq8MvT+U6ImM9/rwmj+YKD5Dbg+ZnwOsE+/6/2n9fhA+yBP4tindKHyfeh:eV19xj+U+pw4Gu+yZ4EndKSftA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654438, "uuid": "63edcd84-bc26-4ca2-b002-cb91a7e28635", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654438, "uuid": "5d5ef81b-53f7-4dd1-8735-cf96939070c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654438, "uuid": "1e595c21-0ffd-4b74-9292-975524b1e2d0", "value": "Maersk BL & PL.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19402b47-ccfe-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623667728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667728, "uuid": "2c7f6a03-53d2-4bb0-8124-1bead3a2b003", "comment": "Malware payload (Loki)", "value": "ead3745d31b251ed665ea1163eb3164c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667728, "uuid": "97b4fea3-27c9-45a5-a8f4-0162ef8168c1", "comment": "Malware payload (Loki)", "value": "aeadf6653dae8d5604cd66d04c621d58809877b0c01df913718184d1306550f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667728, "uuid": "78d4f83e-8c82-481d-a87a-a1f092b23b2a", "comment": "Malware payload (Loki)", "value": "69ff03e5ad6b21dbabeb63fb9aadbec72959d3a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667728, "uuid": "1754d17e-dad1-4e77-9f9b-a335dc48447c", "comment": "Malware payload (Loki)", "value": "df259030b9f7c90c86c012015ec10e64199b8a5479d56735553cd6d97084659b8be4974377808ac35e221e71bb9f8600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667728, "uuid": "3deda125-4291-4919-86ca-1692d76b872f", "value": "7F6412A16E43C995C4891DBBDC87C90417EADF88A837567BB58C730FEF6B3890952318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667728, "uuid": "59a00497-9401-465b-9b02-9d71a9b1f79c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667728, "uuid": "1b68436f-db22-4ee6-9780-5b0a1a70ba1c", "value": "6144:eUhjD0yNKGc+lAeqerfrccBf4EREcc+rwB573+xAdzQcxEjjlcjI:FTVc+lLfrcs4EfCx3nOO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667728, "uuid": "a968fdd2-91aa-41a1-947f-faa188c82a2e", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667728, "uuid": "1b2efdc6-c36c-408d-8238-36c27c9777b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667728, "uuid": "778c0f19-6163-48d3-9e0d-6d71a3bf66c6", "value": "MV KYTHNOS.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67549563-cce0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623654974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654974, "uuid": "815aa643-50a5-4ced-a6ae-075e5de0c1ac", "comment": "Malware payload (AgentTesla)", "value": "6c2f2f8f836dbc90263e23147bcedd21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654974, "uuid": "2918c8a0-6c12-45c8-9659-8db99d238fe6", "comment": "Malware payload (AgentTesla)", "value": "af39612d67991f81d3ab667393420f84905ec64b9f6ac1dc244524b1f6f76463", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654974, "uuid": "652f3797-fd7c-48f1-af86-71da8f166a9a", "comment": "Malware payload (AgentTesla)", "value": "3209023d5433c7cb7818029d52aa7f7713c0e765", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654974, "uuid": "9be4349e-992d-4c54-a264-0ed1b5f1a325", "comment": "Malware payload (AgentTesla)", "value": "9d84cbc0c261ba9d27bf30ab22ad181e6fc28b9ac05965f8a10b49c613f4a12ab3d3ee84bf9172b82c44374bb56282cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654974, "uuid": "9a30ef19-4b55-4ef3-829f-c304b0a5b305", "value": "A8155BFCF198A9B0D1DDC731C2905CA9EBA115FF9242891C19B9DE8C3E33B8A8B5D445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654974, "uuid": "45985ed1-768b-422a-ba3e-dba14b696376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654974, "uuid": "cf93620e-707f-4967-87c0-ed5307039f23", "value": "12288:hi+WLBvTkETHU/b+rKClfBbZB2tIoOSY/ymhBm99Wodh7:hiRvT0/81lfRZ4yml0cFd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654974, "uuid": "1d9b522c-a182-4c78-8132-607bb85cc4ab", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654974, "uuid": "33cebfa2-c4b4-4bd7-a71d-96f3c6f28d00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654974, "uuid": "17ef4199-2d48-4fb4-ba39-a2a4fca2d5ac", "value": "Sepa transfer advice notice Swift EUR89570 20210604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973b5720-cce0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623655054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655054, "uuid": "e792d488-09a5-40ae-baee-1ca5e67c355f", "comment": "Malware payload", "value": "6a33db2f8c3e0e921306622b015e3947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655054, "uuid": "0b7f757f-bd43-4ea7-b533-9904555b3ee6", "comment": "Malware payload", "value": "af9662883eff353ec2bcdf74fc6b309e287ccae571063db7a8176547172805ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655054, "uuid": "b18c2e60-3ffb-4e20-9fcd-f728a3dd63c9", "comment": "Malware payload", "value": "b2584ecdce2a1d998a1c493ede58ca62af2ff977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655054, "uuid": "8b41b437-6ee4-42f5-8c8e-3f6ca0aa71df", "comment": "Malware payload", "value": "43d61fcdd891462654b004ad93f8829e408d09eacdc12135da247c3963afb4d09ad4b15db8bbae4cc9a4a59dcbc386c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655054, "uuid": "4bb1998e-2db4-4b73-bf73-5bc7ab250df3", "value": "9605E02523C88B55F57E47349264019093F1BC27D329EBCEBE9954CC0EA1F8287677AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655054, "uuid": "d57afd52-d602-4469-86e3-075d0abe7615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655054, "uuid": "5b554a37-09ba-44c0-aba5-6626a6ab013a", "value": "12288:Ceel7aTLMYrRHd8SzmOvcbk86Heot5ln8VmE8i2uSCmxAgwM9VCZ6v:QluTLMYl86Hym8nS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623655054, "uuid": "6aa6ecfb-bf93-42a0-b783-b2b8a20471ea", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623655054, "uuid": "a8e44a7b-d09f-4924-8ace-6b56b47e600e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655054, "uuid": "cea5e53b-5aef-4c50-a187-f45e75ef3407", "value": "DHL Import Clearance \u2013 Consignment #6225954602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5109e0ae-ccf3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623663097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663097, "uuid": "fa98d17e-8f89-4c39-b4e1-5638cff45fd3", "comment": "Malware payload (Formbook)", "value": "616a10fdc3307fd483916e1b578c9f9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663097, "uuid": "6056841a-9e5a-47b1-811c-9818ae00995f", "comment": "Malware payload (Formbook)", "value": "af9e4af9e1c7c2991d0fe0e5eedd11a819cb5d697ef75606ae620f3b7fd20775", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663097, "uuid": "19e2ba20-e59a-4bd3-96e4-c82148406173", "comment": "Malware payload (Formbook)", "value": "940a937103f7f406291c416c6ec4d601fbca7234", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663097, "uuid": "fcd1853d-0331-435b-89cb-8c4fa985ead7", "comment": "Malware payload (Formbook)", "value": "ff999afd8154043b39f929a08ad13aa7af3e05ad862cf09b3136f3968e96f0d933ebb9e67f732fa3f3478eb891b09e8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663097, "uuid": "d42a2306-ec2a-4440-b84d-63777e63f98a", "value": "A0157AF1A5B147C3D39EDDF183CAB3848B6F4AA235328215A85C22FC26DD18E55CE587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663097, "uuid": "3aa27a03-453d-45e1-9d7b-402760468c97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663097, "uuid": "a8a5e9c8-58e2-4c67-9668-fef06019b61a", "value": "24576:TuyAioqXVnyKKvkCB7dEnfDzVd+rl7GJNeBUdt:BF1Kv1d2fDJArUJwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623663097, "uuid": "76752177-705b-43e8-8a1d-5c05ff7b698c", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623663097, "uuid": "1f378170-d732-4b18-bd51-2c5ead9b5c05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663097, "uuid": "045012a6-de00-446f-8a8e-385f26f5ebdf", "value": "616a10fdc3307fd483916e1b578c9f9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349af31f-cd07-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623671639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671639, "uuid": "cba44152-1402-46fa-be8e-c10fcf808a0d", "comment": "Malware payload (Formbook)", "value": "e7ee6c9661129b8c410638b98105132c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671639, "uuid": "5537a8e5-26c3-4b81-9e84-617bede32d14", "comment": "Malware payload (Formbook)", "value": "afa313c828bdcc1b4cc7852981eba2673068aa3320761b031551f831ff023fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671639, "uuid": "c5133f8e-2874-49cb-9e21-05d70ca03424", "comment": "Malware payload (Formbook)", "value": "c8024cc872c99d65cc63737d90c1d8bbf4cca991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671639, "uuid": "a9d4123c-b7d8-4043-9fac-3b9ff0a95ab8", "comment": "Malware payload (Formbook)", "value": "977e4106467a33e1e4a12e8c8e0380ea1c134d903f432193c8090a703377354408fbbaa71b3e92206fb0aa59059e3948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671639, "uuid": "77acb07b-2403-47f4-8680-34d36a0e3beb", "value": "BFC4E0CFE79790EDCCE49D74EA9092C5154AA4E62203D51A9CCF620DC8C1AF4BB7162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671639, "uuid": "419df0b2-f759-40fb-879c-8bc903587dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671639, "uuid": "aa95a8ee-d349-450b-8bef-351e046c1f9b", "value": "12288:Y9VC3dMkPcn2zP9TptiPrEtVZ2w/w4PFg1QzZlqd:YudxPcnUptSEtVZ2w/7F/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671639, "uuid": "3f5d784b-643b-4226-9193-dbe51d7a904b", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671639, "uuid": "f22ec16d-5c1f-4d2c-b158-d7f5a7ab3b10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671639, "uuid": "5b896bc3-cd5a-4e26-90ed-1f1bb84039df", "value": "RFQ_MR_4.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ee7910-cd1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623680983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680983, "uuid": "ba8d7417-70f9-46f8-a213-5e02d8ae4529", "comment": "Malware payload (RemcosRAT)", "value": "f65eed32d820770cebbdbefc20ceb2ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680983, "uuid": "c3228ac3-346e-4daa-bc51-739c68d25690", "comment": "Malware payload (RemcosRAT)", "value": "b0117821767ebc6e59c525dcb3477d24f8518262418f9b4f99be37e47e797fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680983, "uuid": "d9ca8508-c580-4c74-a167-1a35a7ba461a", "comment": "Malware payload (RemcosRAT)", "value": "7eb38511ba87bcf008b652b9c51322c01ee21726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680983, "uuid": "b548ad8e-4c76-4c47-960d-c0ddb77feba8", "comment": "Malware payload (RemcosRAT)", "value": "1eed38f0ea1f2f588c47e1e4865d8be31fcc1e1576025fb10431dd0e099d5f600af33a7d483d3e4a8f6661b78996dc2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680983, "uuid": "7b99afc3-9fc4-4eb8-a815-ad65331cf3f0", "value": "6615E02523C88B51E9BE4734D165419093F2BC27D329EBCDBE9954DC0BA1F8183A379B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680983, "uuid": "9c9c742c-7f85-43fa-89c9-1844232abeb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680983, "uuid": "1948bb2a-fdd2-4256-a3e0-a2bc0e9efbc6", "value": "12288:WLe3yaTLM7AepSkG/ZkT61oGhoU/OVH8hLe4EQfYUyIuguBv9VCZ6v:J3TTLM7tskIZGqooogO6FYRIugc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623680983, "uuid": "b96a921f-f90f-4204-803d-0cc32d912832", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623680983, "uuid": "cba3c30a-bcab-4695-b603-10d86436710a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680983, "uuid": "950b2070-d4b8-4418-be26-ccc9006d55a9", "value": "f65eed32d820770cebbdbefc20ceb2ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf32e26-cd0d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623674554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674554, "uuid": "81b1a8f0-8d69-4c73-9af2-9582169137be", "comment": "Malware payload", "value": "45aea0cfe4680ddc7362e355bb5125b7", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674554, "uuid": "a6db99b3-0fad-4a16-bb7d-60c6b45c1ead", "comment": "Malware payload", "value": "b03b3324dabb86f74d4a4ca8ffb5620294bcb34686263cfb6f0f24fec24db00b", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674554, "uuid": "11610bd3-ee5c-40c4-bebd-42f4f44e0212", "comment": "Malware payload", "value": "ec62afd090a8a23a8f4aaea62279182768345a91", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674554, "uuid": "238608df-d5eb-49ed-85f7-583570f0c7d9", "comment": "Malware payload", "value": "0c869a3dd0ed603360715facc22b90e4c4b17676eec0052fb4378a6c300def0eb42506bffcc37c1d2a6d1a846767f757", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674554, "uuid": "f558ff5f-eed4-44f6-a1b3-f1ded0a28305", "value": "1AF3124B61A150FCCF1260311652ADF06E15702BB782FD8F1AE22F8672225D737AD79B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674554, "uuid": "ee41befc-bc12-4aad-af4d-eacdb34dc1fb", "value": "3072:kNmSU9VlUBWA6CFvA7bRCxAVIK2xVymd1xXP+Ph9vajtC1gBbZIrUH:bSU3liWA6FsY2xVyWxf+QegBbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623674554, "uuid": "4e963ac3-2a8d-4a08-952d-02c971005f3c", "value": 158866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623674554, "uuid": "69cffb4d-6e4d-4711-b390-70d16f4a57fa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674554, "uuid": "742de48a-a35d-4f1e-a0ba-fb9a2a264b41", "value": "tender-461487493.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732e2dfa-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647263, "uuid": "6e680801-59a4-4b54-9e7b-738e214a72ee", "comment": "Malware payload (AgentTesla)", "value": "6bccbb1685e7d9957ed1bd9e53636264", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647263, "uuid": "5ba34137-8279-49cb-b430-ec719200479f", "comment": "Malware payload (AgentTesla)", "value": "b18a8dc6d225d963259d1b3547450946822cf8a6e7b62a7cff5705a844cdbcf6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647263, "uuid": "1d624cba-4628-4cf5-923a-df89aa0c5c92", "comment": "Malware payload (AgentTesla)", "value": "144993981ab399480827f8f700d41fb9901adb45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647263, "uuid": "cf7bd835-c95e-41bb-a100-7e67311703e2", "comment": "Malware payload (AgentTesla)", "value": "92f13b769900732d3ddfee03908768fd3b6d85a75070ea26fd1c872c2633210179a6f9f701858175111ddf026b01c4f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647263, "uuid": "c659953c-eaf8-4343-a649-1a33078f49a0", "value": "419401043BEEE129E172AFB6AFF49381A6AEF1766503E64F2541235F0503F80DD5163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647263, "uuid": "b75b2a2a-18ee-4b64-905b-4463168311b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647263, "uuid": "d8613735-2819-47db-8c0e-d835bcb5d120", "value": "12288:GmWg6iwr9RwOD9rKtSPvsfd5ZFmfhxTh2SJ1:GD94Os1OgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647263, "uuid": "f7670c1b-bd8f-47eb-b3ab-1c979c4bc70e", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647263, "uuid": "a057f45f-55c3-4c6e-aa52-e4c4a234a91b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647263, "uuid": "9501d51b-73e8-4746-b80e-cf471c2dc901", "value": "Pl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bd2899-ccd4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623649951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649951, "uuid": "3b369e17-52de-476d-a066-448aa0153fe3", "comment": "Malware payload (AgentTesla)", "value": "aa7caafed0d45f8dba7caad6c0316fcd", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649951, "uuid": "9548dbf7-a64c-455b-99ec-0c38dbd93ee8", "comment": "Malware payload (AgentTesla)", "value": "b1ad3f447610ebb5884b7d1cfb0e8525c5db32d363e2232de2f02b43e5344c49", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649951, "uuid": "c5e47498-93dd-4454-ae7d-e0d99ae8188c", "comment": "Malware payload (AgentTesla)", "value": "c21dbe35f9dcc99c00cc25c803d176c506188e62", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649951, "uuid": "277f7c58-9ee1-454d-92a8-914e9aec070c", "comment": "Malware payload (AgentTesla)", "value": "2f79bb007fcc638c606cfdae4e4f577882e311b14276d7a364c1cdc16cbe653049217dbbd0693e1662b429ff948f6733", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649951, "uuid": "44bb1de8-84ca-4dd9-aeba-2ae3c6e50e65", "value": "C6A4234E088BC672DCB7FF316D149B4A8A9D606106518C9CF1CEA352B094C72E6DB1BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649951, "uuid": "cfaab867-3e77-4b9c-8080-671e11aa466c", "value": "12288:AW66QGZMbLaesfSX90F3weAN8hK6fxqxHq:16zJ3JEJu8hK6fxqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623649951, "uuid": "ed072e56-6565-42a6-bd29-0397d3ec4866", "value": 476418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623649951, "uuid": "78083404-dead-4b1e-a4b2-29601b7d66e0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649951, "uuid": "f365ef44-511e-49de-9eea-581a5093805a", "value": "Bank Slip and our New P.O copy.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91344041-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623652467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652467, "uuid": "5ba33f48-5bef-4687-9f7f-6835d058fce6", "comment": "Malware payload (Formbook)", "value": "3e611533c698cc25934b9c3f82d6489c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652467, "uuid": "46330990-dcdf-42d3-a0f2-423cd25d9807", "comment": "Malware payload (Formbook)", "value": "b1c4a9c27f6fe06bafb72f65bd45401b16cddc3655f0ef5053a72ec27019fb71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652467, "uuid": "a1da61f9-1469-48d1-9d51-8fc336a3ddff", "comment": "Malware payload (Formbook)", "value": "95aeebae9680e6307d930b8cc978787a53e5ba19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652467, "uuid": "8686f8d0-0a16-4cdd-b80d-172eeb2c6efe", "comment": "Malware payload (Formbook)", "value": "1b0bd6396182f8c008021292642ac7ffcca619613ccd577ae9008e1eb183a8d025a22310921e684b8667bf1a89d3f509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652467, "uuid": "aba71c44-1560-40b0-bf78-3c598df98ebc", "value": "98759C1237E8B92FE13E96712574050843F9BE4AD566DB7EFD8871CE09F1A00A311BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652467, "uuid": "cf5387e3-64c2-46a9-a163-740f6f99ab48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652467, "uuid": "8b109df2-cf8f-4f2d-a415-18605a8a6753", "value": "24576:nVYKA7k61zWUVYtXiZmp/ALRwwN5Qpw5Dqc0qkahUUJXBGmMJ:sP1zWUYtXiZmhAqy5Mw5WBqJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652467, "uuid": "d4252eba-8b49-44ec-bcd4-8e2b2efd9caa", "value": 1573376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652467, "uuid": "afdd8f9d-93ea-4bf4-8364-e32a87892be2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652467, "uuid": "36a7bb5a-71ee-4db7-b74f-be839760dcd8", "value": "POWlzL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db5c415-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623654501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654501, "uuid": "07a8f062-a189-46bb-8a2d-608cdd271ca8", "comment": "Malware payload (GuLoader)", "value": "ee83942376ea5717149517fcc832ab9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654501, "uuid": "73317e18-0f3b-4611-8c48-ac203598ffe5", "comment": "Malware payload (GuLoader)", "value": "b3498937a71913d7101fafb04eb48a791106bec97e21839b2e1be8bb55a3f5fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654501, "uuid": "8eecf297-4b86-47fa-99ec-89935a6f2ddc", "comment": "Malware payload (GuLoader)", "value": "ec75b10c6ef046cb63eaa20470ac94529fb4873a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654501, "uuid": "bebe3a4b-1e4a-4ff7-878e-896cc1d0b0e8", "comment": "Malware payload (GuLoader)", "value": "4ec2fb227b9cd23293de6b44680bddeeb954a7cc58ce2c1ee7ea40ad71fa72c4c10eede9c593bb9ee3e74f36d06c2a28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654501, "uuid": "52b083b1-bd41-4023-89f5-bf9c1fbeb497", "value": "88E3C332F2936100F9528170FC11A9FEB9546F312D438D17B6F2BB0D617AEC7BAA1616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654501, "uuid": "f60bbdb5-4c48-4e71-bda9-eed5afdd74af", "value": "2c08d8f9644132654eb702b279083d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654501, "uuid": "0ed0af38-8bb0-449c-b86b-edc9819d71b9", "value": "1536:zK7pvMMhAYlnYgtuELhUQwe6KjEw5bMNccnuMG5reMFbCJQ:zCBqg197dvjEw5yccw5r7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654501, "uuid": "da218106-b487-44f0-b0d5-e4b63b45f455", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654501, "uuid": "258c6108-b8ff-4186-a8f4-0abe715fd531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654501, "uuid": "303438c3-73cb-4ef4-9ef2-bd6b02635c89", "value": "ee83942376ea5717149517fcc832ab9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a081b6-ccdc-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623653500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653500, "uuid": "2a21da20-758b-43ea-b12f-e5671a8c23eb", "comment": "Malware payload (SnakeKeylogger)", "value": "5890cfa8ca5d90d76776f809d72344dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653500, "uuid": "cd860f60-da97-4fe1-a352-567ba8b01780", "comment": "Malware payload (SnakeKeylogger)", "value": "b3e20e85fcf56e82cf7cc63b93bd515c510d3ec4773bc9b5c871080a76430acb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653500, "uuid": "fc77e261-1fbb-455f-ab6a-b9c7641620b3", "comment": "Malware payload (SnakeKeylogger)", "value": "7e68c41df9141b8f93a626d3fc73a7cf39edc0f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653500, "uuid": "acfde53a-3401-4141-b160-703e025d9372", "comment": "Malware payload (SnakeKeylogger)", "value": "102c00157bf4da2f798f1bf985a16f0ac3f172b9d7928b99fa0e1f7d31391b2dc8ae82633928da36bf20870dcf5e33bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653500, "uuid": "88a13cff-20fa-488b-b4c9-22bb2a9a7c17", "value": "DF05492639EE911DF173AF796EF475A69A2EBF632B02641A30D0334E0633941DD814B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653500, "uuid": "34b16e2e-d5a6-4038-aecd-d260784a1fb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653500, "uuid": "a4589994-87bd-41b1-9fbc-0ececa5561b9", "value": "12288:HrfzISoxk7H4KUc3KiV7EipPhbnYXREAEYNtoq8vVflvFBspATai9rkDY3i6qI+M:nAKV4U5f0GrCfFP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653500, "uuid": "a1c2b43b-023b-412d-bdc1-bc906820ef51", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653500, "uuid": "d7c0b637-4c2a-489f-a5ee-b1282af664fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653500, "uuid": "6e352b54-18a6-499d-8b0a-153486cb5983", "value": "Scan-Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50e0ff3-cce0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623655212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655212, "uuid": "12e6dc2d-98c2-41e1-956e-e68990bb6e9d", "comment": "Malware payload (AgentTesla)", "value": "46d05e6a5e079f8eb5320bc19301e47b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655212, "uuid": "b529e525-fde2-45ff-b4e8-33776d5a677e", "comment": "Malware payload (AgentTesla)", "value": "b578332fb4efc3102a6885a26aa42f6e596cdb2941df48c055dfc4e5ba87d3f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655212, "uuid": "f5872247-6ca9-4268-a8c9-a7e73852b15e", "comment": "Malware payload (AgentTesla)", "value": "fd4076dff215f94c94a8962ec223166d3c6185f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655212, "uuid": "186a4af8-87c8-453c-8415-75002af21b53", "comment": "Malware payload (AgentTesla)", "value": "45e401e0d0ce74632e89c97e7b216b6c69bb600bdf56c993c66e2d47d3b9338c65d3a241a36b3d774da2544562d97c85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655212, "uuid": "6384e88b-9802-4b87-8366-89a2839e6705", "value": "10F4C0F17FA1DBA5F02202B5840296635F03AC7EE50FC0D76442BE165E7EA8358DA6C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655212, "uuid": "be3e244a-ca5e-4091-b47e-ef564029e16d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655212, "uuid": "ec7c750c-94a1-4e7f-9b23-1286f91af944", "value": "12288:PCtjFKDwUV9YQwrSD0oC2lgBb5MHGG3yd2OluON4fA9uwkCp:PCVMwUV9YzWorGgXG3yd2OluON4fA9uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623655212, "uuid": "51aa4ab6-6c1a-4e6b-9c63-60098d91e3a1", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623655212, "uuid": "bc8a75bc-e0ca-428b-af81-210806311b33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655212, "uuid": "6909ad14-784c-4e8d-8033-6ea672d28f55", "value": "PO-1421YJT0005971 Order - Xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8bb89f-ccf3-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623663114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663114, "uuid": "536b25fc-5ac6-453b-a6c2-f095d0f64b44", "comment": "Malware payload (DCRat)", "value": "b1a9ed1893ca8920992c240ec1492955", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663114, "uuid": "9de39a05-079d-43c6-b0fd-a7b53b743892", "comment": "Malware payload (DCRat)", "value": "b62c4e09a4903b55838ace08f1c81e54904e5c9e9dbb681b3aef3d53fdc2474d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663114, "uuid": "644a4453-5ac9-4724-9e4a-2a35bc936a3d", "comment": "Malware payload (DCRat)", "value": "38b7c2ff9c3217507553b9e4e7cf3334652f1ff0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663114, "uuid": "9e1ff522-14b3-4673-a0d1-5b5a836b2890", "comment": "Malware payload (DCRat)", "value": "84115fb853f4cb162257ecd418e909946bb386fc3dcc152ea560549190a3fbc7f24186558342cbdf9d8b32cc0d8213b4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663114, "uuid": "932ad79f-2c1f-40f9-a9c3-c3dd79dea214", "value": "2C256D127684CD11C1792736E9EF491447BCEF003A62EA3B7E9A326CE5633924D0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663114, "uuid": "f01ed1ca-a2a1-4376-a155-194149bb4198", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663114, "uuid": "d973fc06-44d7-4db1-ad8b-e1afdf5c621d", "value": "24576:U2G/nvxW3Ww0tPVgfIW9AIdxg2BeI/S+g:UbA30NNkXqklg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623663114, "uuid": "59410a0d-0831-4b30-ad2e-ee729b819379", "value": 1045633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623663114, "uuid": "4ef3de54-418a-42dd-b7f7-3d479814f966", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663114, "uuid": "7d0a612e-0d50-4c7d-a71c-0bcdf054c284", "value": "b1a9ed1893ca8920992c240ec1492955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81645a41-cce3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623656306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656306, "uuid": "97c40382-2459-4faa-a6c6-304d19418e4b", "comment": "Malware payload (AgentTesla)", "value": "c745aa5e165c71ac6368dc00de91899c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656306, "uuid": "e0d9fa1e-c121-4553-826e-667a5e54c96d", "comment": "Malware payload (AgentTesla)", "value": "b63e4b89c7f5c5f0137072a95f603c212e8a05de59dd8d6ffeb16ec7728959a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656306, "uuid": "30a6993e-da58-45d0-acbd-58380da81234", "comment": "Malware payload (AgentTesla)", "value": "d22b9079313dafb7824d92f6bef69c3db6441a6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623656306, "uuid": "7da71376-68b9-42b5-adff-c044e5cefcdc", "comment": "Malware payload (AgentTesla)", "value": "dd2a7854a411ff6571532b80a9a095f1c3e1a26b50dbb8508240cb8414a0cdae5c8da62c72fa5b1a2e137f937b20e640", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623656306, "uuid": "e01bb6f6-1982-4fb5-a52f-98ae41a068dd", "value": "CF611875778A4920D77586D3857C7A2E07E03586C2C79A4C71AC8FC60327352CD91D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623656306, "uuid": "45e3d685-8001-48d0-8b23-788058aa4248", "value": "96:dsGxDeCQQNQ1EXUKvJA8Po2FbYQcdSVIoVQSCiyEy:dsGxaCCUUsJXiQcYQStjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623656306, "uuid": "e6c59f95-4e8c-4236-91a7-7bcce46e7bc9", "value": 3464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623656306, "uuid": "ecdc433b-1d73-4e37-b807-bb662969de20", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623656306, "uuid": "813abb2f-cdfc-4d5d-9894-7d2e8ae37658", "value": "Purchase Order_01021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631b7ffc-cd31-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623689756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689756, "uuid": "eb93fbec-61f5-4392-b4c9-75606034ccff", "comment": "Malware payload", "value": "c4d8200a28032eea56da319a55cb468e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689756, "uuid": "efa8ab74-6344-454c-a9b1-eb5be71d9039", "comment": "Malware payload", "value": "b6dbe343899fbfd10fa3e0cbb5537a6108751e4286065f00298d6515004124e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689756, "uuid": "4e8671b7-d906-4792-9fa9-9266dd69b76c", "comment": "Malware payload", "value": "fd07b9a3f750aaed631a72bc05a0d5a57fd458fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623689756, "uuid": "3da33f4c-bf53-4128-b211-303ed452120c", "comment": "Malware payload", "value": "4b099f73c01568f1df8abd6af917e80eb52d69404d7cf1f7e45e4c7d0e886ff1d4fdde7643601ed3d1f0f0ecf3aadae6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689756, "uuid": "3825c5b6-3338-4c16-bf68-2315d3c61171", "value": "19460A825B406FDBE5DC97B1C21104AE8F989EB92E43DEBB350176B7E8077921F03A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689756, "uuid": "e0d35adb-e928-4daa-82b1-475fd5f4a116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689756, "uuid": "384e5353-a697-4db0-8ba5-d4d8589ca85d", "value": "49152:l95orvWuR8l5t3feg0hQKXVQRVaBo3px3BS8j2VxNKOP:75odWbtPIPXVQ6Bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623689756, "uuid": "2b633022-fe60-45b8-a560-25dc9ae2b032", "value": 5637632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623689756, "uuid": "04b412a8-b0d6-41ee-82d3-a1ffa917e426", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623689756, "uuid": "55dc41a6-c156-43aa-b1b2-cab381f6f246", "value": "c4d8200a28032eea56da319a55cb468e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd99c5a-ccea-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623659414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659414, "uuid": "1d0cdebd-d8bd-4819-a1cd-983e49a1393a", "comment": "Malware payload (DanaBot)", "value": "10b43e3a0ea62d2da4c09a1377ca8eba", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659414, "uuid": "13cd1e2f-aa4f-4a3a-8bf8-e2c4be087818", "comment": "Malware payload (DanaBot)", "value": "b76c0b97e9a444717580fdb3e3c26cd38ae42366761eda3b2a10868614eee0fe", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659414, "uuid": "20cdaf72-42a1-4ace-9873-9c7c31c0fda2", "comment": "Malware payload (DanaBot)", "value": "7d03bb47e0284f6a139849c2190c16a0c0b68379", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659414, "uuid": "6364c63c-76b2-4f3a-894b-1de44e5a67b5", "comment": "Malware payload (DanaBot)", "value": "f03a19788f3aa0eb71b42f5f93ed75a5125d853901b710da69c71473de1bf4c93edc1374bc4f7ceaee01b3d0b056d277", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659414, "uuid": "241b469e-654a-406f-8eb8-3171bf1797bc", "value": "BD563340ABE0C0E9F1B603F19B354E36E5BD69D0AB28A4EF47C53AF516246D0AD30767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659414, "uuid": "f6cf252b-58be-4913-9eeb-dbc5a5ccc229", "value": "58959b365b24aa3c98eb39fa519e2c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659414, "uuid": "5d0b2642-bd7b-4a09-b184-e87fdef30887", "value": "98304:6DcuJqI/LW3C/lcZGu+6ULgKPCYo0lCqrtk+KSC/aQ69cZSg84U3w0Ly:6xPjB9c8u+NgKPCP0lvrpKDiJ9Z33A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623659414, "uuid": "6684567b-ae03-4a40-9cc2-6990b95134fe", "value": 6348288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623659414, "uuid": "a74b02db-b72a-4191-99d4-167c6e5061bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659414, "uuid": "ed894db7-4347-47ed-a244-72fa7e835423", "value": "10b43e3a0ea62d2da4c09a1377ca8eba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40497533-ccd6-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623650613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650613, "uuid": "6d1473b6-1551-4ce4-89dc-05437c820a1f", "comment": "Malware payload (AveMariaRAT)", "value": "dc41b3c367c1d2d128ab5a1bdbd62abc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650613, "uuid": "c347d527-c0c6-44b4-8b64-dbaa694fc17f", "comment": "Malware payload (AveMariaRAT)", "value": "b77ca2c247c1a659063b98829a0a6211e9c708f9ba40a691e02a4e8ab3cfb45b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650613, "uuid": "36d9123c-1775-400c-bf5b-8383d4ad1764", "comment": "Malware payload (AveMariaRAT)", "value": "297d9d6131dd7b147ec56150fa43b265a4cd1f45", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650613, "uuid": "b11df169-d3ea-4664-b8f4-e37401352830", "comment": "Malware payload (AveMariaRAT)", "value": "aff7e3501707514fb83cf39fe90bc7e8a188d900f67145244857e42737972d7f09a0044c806c168f2525d800d8c66417", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650613, "uuid": "000e3058-fb10-407c-9283-2b44a0fb36e3", "value": "8F34F155508188B3F37163791235AE69FBBA6DD81DF90C0BEB90367632F60CB5098A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650613, "uuid": "938b182d-f54c-4fc9-8858-e678ded306e1", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650613, "uuid": "afa41b39-2f19-4341-86ba-953d15df271c", "value": "6144:ysrlhMA8U3p2msCsiXt6atVHfDsSwBeqC1/:JlhJh3p2mZZtdsXeqg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650613, "uuid": "a49576ae-a1e0-4ed6-9704-f74d768fc03f", "value": 236759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650613, "uuid": "60e4f380-5090-481a-86d5-a396773364f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650613, "uuid": "dc9a7bb2-bac6-487d-a09a-382c6427eae6", "value": "DHL_June 2021 at 11M_9BZ7290_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb71eec-ccb9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623638177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623638177, "uuid": "3427b03c-b1dc-48fc-af8b-2c6c1a033012", "comment": "Malware payload (AgentTesla)", "value": "ad146638428cc484cabbae3c8065434f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623638177, "uuid": "d74f29d6-6d32-45a0-8a5b-937d57423316", "comment": "Malware payload (AgentTesla)", "value": "b786e3919cd022e14e2b733ce3616cc8614dc3d0668f562dbceaa20709fcc36e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623638177, "uuid": "f67946db-e084-403f-b56b-51479f95daff", "comment": "Malware payload (AgentTesla)", "value": "2a75021dbdfe46a335f1065dde74bf80eaa8a150", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623638177, "uuid": "5abd3eec-01c8-43ad-8466-16d4e028ea92", "comment": "Malware payload (AgentTesla)", "value": "32309a1139961184261546fb12be8b5db426455c3c05a5a9910b9c1fbf74bfb5c38a1ad691221b5a773d5a9bcd2755bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623638177, "uuid": "9815759e-e008-44cc-b0f9-1bf8f1fce12c", "value": "10A402003BE8602AE2359F7F66E4B785D57EB176550BF58F389163068A03F80D99363B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623638177, "uuid": "4a77112d-83c8-49a5-80c1-00673f0c28cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623638177, "uuid": "4b78ae05-5104-46d3-a387-af1b402c0147", "value": "12288:TyBXA3h8nL4R00yJ2P6/prNKykkDWnsRf7twcS6q:TymxMLGT7y/RIKWsh7tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623638177, "uuid": "172159df-9236-4395-8cf2-ce68baa075c0", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623638177, "uuid": "e23dfee6-af02-42c1-a91e-ca6e88514f85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623638177, "uuid": "dfbf93f1-6c9d-4f19-9d52-91ce7fba980a", "value": "SecuriteInfo.com.ArtemisAD146638428C.3998.30690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeacdef1-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652087, "uuid": "4661afc7-320b-4cc5-a5fd-d144550bdd16", "comment": "Malware payload (Mirai)", "value": "dc0ed496870aaf98f841335293c1cacb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652087, "uuid": "d72292f8-5403-4079-9d77-548e0e89d185", "comment": "Malware payload (Mirai)", "value": "b79e80f325f7bd017c96a7db05a1270995388e9216d545a41ec56edc15bbf9db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652087, "uuid": "13ae1ebc-b1f7-4243-84f3-6ebae5fd96cd", "comment": "Malware payload (Mirai)", "value": "edd3eeed78b44b00df97e35d1dac4ea4db8d387f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652087, "uuid": "93f1073d-ec5b-4c1d-8c6f-68f7e7343fcc", "comment": "Malware payload (Mirai)", "value": "15fc575d795a9f60c35a346c6d6eb676eadf399bdc0e06b65bc13c7dc25c63444c7c1573e8d7f9f42e7081848d89e4f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652087, "uuid": "1ce0ecbc-c6cf-4d68-8778-c4a3a991c237", "value": "AD34726AAB329EBBD80ECE77019E4505104C994A53D92F6FF2B4D618E39BD0F48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652087, "uuid": "40fe58dd-920b-42b5-84be-0cc79870c9b7", "value": "3072:Zqb5fLbJu4v8VJIrQFc51ekgGfeTXhq/FSKmk2w7x6m70zeaFswGQcYK:cbeLQ/EKmkBl6m70zeaFswGQcYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652087, "uuid": "ffa0ac01-a285-431a-9083-187f9e92b533", "value": 233828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652087, "uuid": "f3b1b3b7-088c-4522-99ec-fd2e47c7cf39", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652087, "uuid": "8eceac20-1dcc-4923-b81c-d4b4c52f8130", "value": "dc0ed496870aaf98f841335293c1cacb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb4c081-ccd3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623649592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649592, "uuid": "05c0364f-60db-490f-89f3-7cc8b004dff1", "comment": "Malware payload (AgentTesla)", "value": "1f697a29604661229dbbf87ae723c57f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649592, "uuid": "ce1b3bb3-cf81-4e8d-a93f-2d784e8fe59d", "comment": "Malware payload (AgentTesla)", "value": "b83b99848a65faeff5bc9765a2fb5127401ef4cfc2b1d62dead2fe58f3d1b84b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649592, "uuid": "b2024367-996c-4aae-b56c-1b401cd8bd09", "comment": "Malware payload (AgentTesla)", "value": "92890d6054ddfdc21c9faf94270a639f27e31ff5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649592, "uuid": "e1fd8df4-d295-463a-939f-f9e7303a2222", "comment": "Malware payload (AgentTesla)", "value": "ee0637264ee570c6e71a1f03d79d91fe35864221beae3c7103ceedc7adbe0d74d5f3d15d2c22bd884c95c5d33d37c400", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649592, "uuid": "41896601-48aa-485b-a8d9-2b176032af00", "value": "7205493439FA501AB1B3EFAA4BE475D6DA6FB7733B07A45D1090038A4723A81DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649592, "uuid": "9873edee-6638-4466-8563-ff15008e56a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649592, "uuid": "471941c2-54a0-47d5-833f-a6afaeeb4a63", "value": "12288:YaHVUxAgA9Clt9CCbUL00K2Hn2BSh6cF0Ty8NGKY5OL6nq8kmK7vbL2i2HEDg2KW:VY3rbalHLcYyP3LNRg2Yk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623649592, "uuid": "ffcc8cbd-cc7f-48c6-a2ef-91d5b2ca841d", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623649592, "uuid": "11313202-9447-495d-8746-25bbbc61e1cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649592, "uuid": "14d66646-6131-4751-8ad2-1f7620a005a3", "value": "Request for Price Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54a3609-ccfb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623666674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623666674, "uuid": "d4b825ca-7b69-4d79-af28-14df18c334e0", "comment": "Malware payload (AgentTesla)", "value": "2bd37c2c98f5934ecabcf0fe748e70c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623666674, "uuid": "01396a3b-2dbb-4af3-b51a-605b6f3acafb", "comment": "Malware payload (AgentTesla)", "value": "b860ca3d367ef99f5737c030e9ac79f434d6bd3c0817b5ec09f37ef4dacd9c5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623666674, "uuid": "8a2a0edf-2bc7-4e6e-acdf-703de9a4bda0", "comment": "Malware payload (AgentTesla)", "value": "cf9f652fc674349fa9ad3c05f94a471d6637d97b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623666674, "uuid": "cf2760d7-6a54-4c52-8ffe-cc29969d2661", "comment": "Malware payload (AgentTesla)", "value": "9b830f5e258ca1ce1bd6839bf25a9f91e93b2bca24185a3ef8baf6cbc3389daf63bcc474a3c48bd18c14afd33f2ebd81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623666674, "uuid": "1ffdb5d7-219d-48d5-a032-d76b38ac343f", "value": "96E423467AD90A2FC843E426885557C07D6664107D885DEEFF22F68C9EF1E4839B1C3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623666674, "uuid": "d649d786-a694-4302-94fa-2a41b8b9583c", "value": "12288:dzIY6c+9rRjX52PPFHuVry1u3NAuIJE6Rqx2q26+2BnTsnjmWbyoqmJBXvaoWhR:ND6T1Rj8ZuauV0drqH+AnTmjmS1JXvne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623666674, "uuid": "256af5e0-b0af-4138-8e4e-00498fc6354b", "value": 690278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623666674, "uuid": "9c76510e-f2a6-4251-963c-d89ff5ec95a3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623666674, "uuid": "70fddacc-7787-4748-b1e2-6928cd3ba253", "value": "Scanned Copy for our payment.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae34346a-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623652086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652086, "uuid": "3607d957-e9e9-4bd8-be9c-e51121bc2988", "comment": "Malware payload (AgentTesla)", "value": "83936e787abd20ad818627c5edfbc634", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652086, "uuid": "bc178a09-c6d9-4185-a3b0-23363c1e0559", "comment": "Malware payload (AgentTesla)", "value": "b91b04255ea77663ca4366d04891a97b94d8a03984a1f69f052439ecec6122fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652086, "uuid": "ef507972-81e1-4a12-80cd-8b92d219f70a", "comment": "Malware payload (AgentTesla)", "value": "1c33193115b1bcb882e5fd84f8ade4d749299d3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652086, "uuid": "fe548965-bde9-4047-a4d9-aae72311dca3", "comment": "Malware payload (AgentTesla)", "value": "a2bb98576747e3e42407bb274d538cef3bcb0ea1da4cc0bbe80b2eafce015b776ce75181154db6297e4dc08cc6504fe4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652086, "uuid": "d2413b64-4d81-4d42-b5ac-ec1121f1b4e6", "value": "9534129142858969CC3346F092B70D1118FBFFEA85B6DE8E41C9F7B6C6733866533982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652086, "uuid": "13f55cba-ccff-41ef-8cbf-f690d8f2d9e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652086, "uuid": "c82a9552-cb93-4b8c-bdd9-f8da1de97686", "value": "6144:XgxnF1M9lTTD858/UO8mkhlhNdJNi01d6kBbjz:8DM9lTskUnxl5JNj1dJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652086, "uuid": "c7ba48c9-e59a-4dca-9849-93af16769e89", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652086, "uuid": "48d623b2-e85f-411c-91e8-74c97cb9bbc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652086, "uuid": "ca65e376-c8e9-4be8-8196-dfc3f4309cd8", "value": "PO#0953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91697a54-cd00-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623668788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668788, "uuid": "fd975035-2483-4589-b449-f19d0d18f892", "comment": "Malware payload (Loki)", "value": "a8ea0a313faa1ddf03469eb46186280a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668788, "uuid": "ee33f3dd-224e-4fc4-9e17-331e85a58a60", "comment": "Malware payload (Loki)", "value": "bb0c082e6043a7436075081877360a781328a131c3c7196ff273e838dd075d9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668788, "uuid": "1b90d089-85ca-48e3-82fd-fdc6e66b9da9", "comment": "Malware payload (Loki)", "value": "8272bdd3148fda58a03d7c62d2ae565d5fe07237", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623668788, "uuid": "f30ba676-493c-4380-a526-96812a0a0ba1", "comment": "Malware payload (Loki)", "value": "f89a8c3d49a8e77d86e386fa8d84c5ab562a608192e7c3b077cd22caf7d14a85568beff8be21d5209bacde9c243fd15d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668788, "uuid": "4949a64a-ab0c-4f9e-b7ff-b9d9b4301767", "value": "EAF4E02523D88B45F67E4734A265459083F1BC1BD32AEFCCBE9914CD0EA1F81876276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668788, "uuid": "b95ced15-e540-413d-a167-518c9277402a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668788, "uuid": "f7212e89-cab7-4538-9d05-6bf8a7662ea1", "value": "12288:MWPeAYaTLMN9g6q9M6WOYVxxNC5Pi6x7tgRPU8HpUMTxMyg0nT94QG9VCZ6v:5GAFTLMN9g68eOwxxQ2UMUMCSTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623668788, "uuid": "5db587d4-dc4b-4f35-9b9b-f04b592c49d7", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623668788, "uuid": "dda3f327-9978-4c5f-a4c9-d0ec7ee7c470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623668788, "uuid": "557406d1-e870-4bc9-8fd7-fa3ad8bbf48d", "value": "ORGINAL SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158cda45-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647106, "uuid": "75661dd8-1e31-49f6-91a3-4889aab9f6f0", "comment": "Malware payload (AgentTesla)", "value": "802e0336057d3f05d974664c52737635", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647106, "uuid": "41a6edc7-493d-4f09-92e3-c7a080591f02", "comment": "Malware payload (AgentTesla)", "value": "bb739ce9108a4b006bef55dd1e9d2495e482dacef0bb081a71aa946c95634080", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647106, "uuid": "5aa96e0d-8a71-4207-a12a-96af6515d92e", "comment": "Malware payload (AgentTesla)", "value": "0f5b5b6ed7fcb17aaccd1e2398563a31aa96e846", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647106, "uuid": "6295b369-02c7-4b01-9f8d-bcc189cec25b", "comment": "Malware payload (AgentTesla)", "value": "5db4a89cb2e2e9f279eebc5533af1b66e35145171161fd2a8a6af8b3c876f0b46f7b4e4cf9ed5aff365cec96376da222", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647106, "uuid": "e3506f65-dd1a-42de-ae1e-312b24ea1e3b", "value": "2435C012B255896AD03E89304472D1FC05F1EF8E6B29F79B3DC07A6F6D72384C962B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647106, "uuid": "27ca2126-0b4e-45c4-ab25-35c2aaa499e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647106, "uuid": "9731be98-6f10-4a9b-8196-315d660d780c", "value": "12288:ccLFwlYC9uMouubY1+pIz1jdpQO/4nnyjdf3Uff1rJMkPsmt9VCZ6vP:cmgsMB0/6jduO/kyq1rJMkPL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647106, "uuid": "9c592731-f351-4a47-9722-d1819b978f7e", "value": 1159680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647106, "uuid": "ca458e68-dfee-4464-9b6d-379cf11e9a43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647106, "uuid": "8c8b3a22-bfe3-4d98-ba4c-e3d7c4a8183f", "value": "Shipping Documens_000000000000009.pdf(182KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7a586d-ccd1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623648485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648485, "uuid": "df7b3cf0-7870-4e0d-8be0-9aee8a25d5de", "comment": "Malware payload (Formbook)", "value": "5c9832057e0adc48a9bba2ce7756fe79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648485, "uuid": "b7310431-edc7-4c48-8270-4fea89a9fe45", "comment": "Malware payload (Formbook)", "value": "bc348990c0e735b8de2b3a92a45d1025d62b8e0ce23c364cdc9467aa566efc48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648485, "uuid": "cc555de3-6e86-4278-acbc-166a442cddfe", "comment": "Malware payload (Formbook)", "value": "66eb6d2d08d2265c21330c2d8a8c39b15a7dc203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648485, "uuid": "cd440fa9-0ddd-4606-a272-bfc930161452", "comment": "Malware payload (Formbook)", "value": "954396969c1d1c3d43155be383fa0b5067877c8d64690e3199b937210b45c6a966c5a75c9a1ff2b5c61520e251c3c87a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648485, "uuid": "2bdb84da-8f2c-469e-a3d0-dba5469e304d", "value": "F074BD41B1C2A0DFE2552333954EBBF991276E296D14D00F23A17FBEBB333462A165C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648485, "uuid": "ae8c6cc5-65c2-4c44-a4db-62d0c7b8c665", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648485, "uuid": "c866bf0a-7695-44a9-8a67-643436c05c25", "value": "6144:Msu5UGgERb8iGnq4nWBJc4u10IQNQrrBZQvcnjjnbm+w:K5UGgS8iGnq4WDcX16srBmUnvn6+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623648485, "uuid": "9a2c5a39-4542-4818-b48a-138b7f750fee", "value": 367885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623648485, "uuid": "66a65aeb-0f1c-42b8-815c-f607e94fddf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648485, "uuid": "1b820484-a58d-4565-8457-073ed5a33f31", "value": "Request for quotation,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce130af-cd3f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623695678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695678, "uuid": "ed70a4be-6622-49d7-a322-256c6f7320a9", "comment": "Malware payload (AgentTesla)", "value": "6e83862d8d56fa0c0637ca294235c11f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695678, "uuid": "a64121ce-2550-4d6b-8d02-6e28866eca11", "comment": "Malware payload (AgentTesla)", "value": "bc8cccac7cb9c94c79e3d4456e661a4c3de1acebc5d8880dc06172170f0264fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695678, "uuid": "a21e19a9-261d-4865-bd45-6d3eed0544c2", "comment": "Malware payload (AgentTesla)", "value": "8045878bedad5a2a0e2424d4c3e12779ca8c3223", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623695678, "uuid": "9d513768-fa95-4027-84f5-c1cf8942bec2", "comment": "Malware payload (AgentTesla)", "value": "1e34ec320270dc9de28976fb05cb4504a05f2e96e4a6146a5fd5c068f13d24243655e9364dd3e630cb86111ec8d94d8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695678, "uuid": "9a4a61f9-c460-4a21-b727-40b4f4c5774e", "value": "3025CF534ECF866AD2744DB56B71EC8782325CA9260873223EC074BDD9375EED8AF502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695678, "uuid": "547e7b70-c60a-4204-9555-0f3a32643f42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695678, "uuid": "fa1c9b90-0d28-4b11-9ef2-ce0aa8e6cdc9", "value": "12288:N9ASMPQipP5bVmge7aOuvBV51pH/eKYWZ1Z9r+eVhEKpwxCrzA8qvaESyh:bipFVmgzrBDHGKYWZ1Z/hvpSAGaESyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623695678, "uuid": "7ba3c1db-976f-4dd6-8042-56bdea6b1575", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623695678, "uuid": "3142f5bb-7b20-454b-b805-ae51c196a32d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623695678, "uuid": "2f72a006-e794-4b6f-9dab-ba3e5eb22a96", "value": "TRANSFER COPY FOR SHIPMENT FROM AMERICA-PAYMENTS 883-725-990-0000..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e20427-cd06-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623671324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671324, "uuid": "015a37b0-b6f1-450f-a3f5-aabf89c07591", "comment": "Malware payload (Loki)", "value": "950ada8622b47834ed0f8d65d385faa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671324, "uuid": "c6fe8c31-80e9-4d2d-9208-c255fe0e709f", "comment": "Malware payload (Loki)", "value": "bd125001d0ab3671c284aeb338190beebcc6063dbae619a8197fe1b198023016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671324, "uuid": "5f4b7888-b26e-4d68-9f48-35827db2ee9a", "comment": "Malware payload (Loki)", "value": "6fe9ca76825b7172d8f5b693f3774a5d2ad0b52c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671324, "uuid": "fb09f344-b7b2-4d9a-9284-743b1eee4628", "comment": "Malware payload (Loki)", "value": "32d0c874410b0e940292c3c2d9589d970b578ebfadb1b44ffa1bd554ab12266df90e086ab7ea3032f9f519980760c400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671324, "uuid": "03243dff-ce1c-47fe-8fc4-086ed61c705d", "value": "84545890D3D252E6E4EBEEB1D7924400B1A45E4D047FBCB69A04FE048DB76FB35606D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671324, "uuid": "b9401c39-5a1f-4132-b122-36c1ac23a19c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671324, "uuid": "b5b16c40-fba4-4b6c-8e8c-00df849753b2", "value": "6144:K1OnABmWp4hV3uD2nlrm/LjOCxVThQ/MeQVZWzFg9:KwnWpwtVlrmhxfEMeHzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671324, "uuid": "e3de26fb-8ab3-4cb1-9e5f-93a7a253380c", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671324, "uuid": "74c6568c-83fd-4936-938e-ff1c9df9d5cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671324, "uuid": "e883baf1-50cf-4ce1-be8d-1ee085d88edb", "value": "Estatment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b73079-ccd7-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623651072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651072, "uuid": "dc74bcb4-a094-4aa4-b4af-8fe14c78ce5d", "comment": "Malware payload (OskiStealer)", "value": "1e3efd26f966bca4f18c36d64fa21341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651072, "uuid": "321b0d42-94d6-435d-a1af-48006adf66e0", "comment": "Malware payload (OskiStealer)", "value": "bed7bde808f7f069703d1655dd9762ec3744f7d991218654f2f6f41fc6383e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651072, "uuid": "f58831a1-b5fa-4a22-a586-0e0a5fccd066", "comment": "Malware payload (OskiStealer)", "value": "1461c5cf12989068b1afd4bdd0514850ab99b188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651072, "uuid": "d1feaf88-7373-4c17-876c-a15a827b46c6", "comment": "Malware payload (OskiStealer)", "value": "fe8c51c6843cecd072359dfce3e236fdaa279b0622d3ecf9c4696520f4ecb571c66e61a880d2a555ed8a5be207781240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651072, "uuid": "305a2bdb-6e82-43c6-be4b-5bf6233e0900", "value": "7A54022B43CB5601E98A0BF55CE28C5BA5F9E320182F66F37449293FDE09B879712137", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651072, "uuid": "e89ffeeb-3768-43b3-8c0e-9c6aa0817477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651072, "uuid": "5b6ac599-fe04-478d-832d-2352d1136099", "value": "6144:VgsKXQ42ZYJ2IJIRDuX27daSpkgiBW9WrDw1yEgU1:+LQS9JEKG7VRiBkW/wgU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651072, "uuid": "0f5b29d2-643d-45fc-bedb-f00a9d956038", "value": 289776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651072, "uuid": "374ff9d2-d639-4e65-8079-b56f30587125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651072, "uuid": "654e4e6b-4810-49eb-96cf-c4b937599863", "value": "IMG0111060269.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2547c5-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623653938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653938, "uuid": "820216d7-3c50-4934-8b39-b521373a7b50", "comment": "Malware payload (SnakeKeylogger)", "value": "bea232962497209e7772c6820bf90187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653938, "uuid": "3e9dd10a-b3b2-415b-991c-0485619e8b9b", "comment": "Malware payload (SnakeKeylogger)", "value": "bf99b9c5edd41fd16fc1f1dceb6422385e532b25587c42027a6ee8c2e197383f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653938, "uuid": "bf6abcb0-c30c-4f28-9c70-cfc1b3071a70", "comment": "Malware payload (SnakeKeylogger)", "value": "429f14f73198245152964855da674b8f5a601059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653938, "uuid": "6aa7be84-568d-4cdd-8b6a-db8eae7837a7", "comment": "Malware payload (SnakeKeylogger)", "value": "9709dac2534e1a165c27b5dbbfa56357e84ce6528fc6ffac155b647d2ae8518b8b4e71845d52d7a61f0ffbe5e82bc796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653938, "uuid": "077ccf9b-e42e-4ae5-91a3-7b7f013295a6", "value": "96159DF4F59898B0C15ECB72D7919CADEBA111FE5303892C0AB9DA8C1F0379A8F5D845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653938, "uuid": "bd863641-2a72-491b-b099-fbe5e2ab7dfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653938, "uuid": "c57e1137-a4b1-4716-ae94-d021b311f81a", "value": "24576:BAJWIa8XWbJpo/HajE3ASHxBTElpXO4gsTxpVXr:cXWbgEEtH7ElhbpTDVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653938, "uuid": "d36104be-2b40-4787-8656-0cc808f718d3", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653938, "uuid": "3b59551c-d950-4cd9-a875-0cdbbd2f3244", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653938, "uuid": "bb48e44a-9bf6-4b42-a069-e67653651d16", "value": "21141007 _21000122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7d7b14-ccc2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623642129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642129, "uuid": "2dfc284e-7537-4688-a43e-e17aba85ae48", "comment": "Malware payload (AgentTesla)", "value": "4432378afb3bfaf90c84ac74d437bbe5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642129, "uuid": "a571f3ab-918c-4035-9060-0794afcd82e4", "comment": "Malware payload (AgentTesla)", "value": "c0db21bc0fb6b3181eb72e8077903c47346540a79a36fc69640fa47fac62e657", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642129, "uuid": "b9011537-2a19-4fc7-a326-0e7a7689e2ab", "comment": "Malware payload (AgentTesla)", "value": "715f35891d8dc58b07e0fe957fe5c2b59fbcde23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623642129, "uuid": "e866bac3-5b28-44d2-8b3a-e77d3488e3ae", "comment": "Malware payload (AgentTesla)", "value": "509144360083549db7c96409d1a5dcf5974f2d7d0c6e357c00a801ffe9e03310d6766b43201dbaad9fdcc2f46f687dba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642129, "uuid": "5d9fb80a-d3b9-43aa-8145-702f54e39c3b", "value": "DA0501AC711035EEC46BC032CAA42CA5EAA03477435B565B951B11BFAE0E9C7CF294F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642129, "uuid": "dbe41fc4-5729-45fb-ac54-4679a78cba76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642129, "uuid": "9c9eac65-59e9-4164-acc6-7684687a62e5", "value": "24576:qNeBUdtQqIA4Fe+xWypuimGVRWLS6AzzhdREeEiUEEE3pO+:qwBUQm4FWyY7sRWLSNREeEiUEEE3pO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623642129, "uuid": "62a2758d-90fd-486b-a612-52be02458ac2", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623642129, "uuid": "0e926842-e7b5-457d-ade1-d61f6ebaccba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623642129, "uuid": "7dbee56a-400b-48dd-8f40-3dcaab8a4369", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.11409.28988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc751504-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623653855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653855, "uuid": "59e7009f-3d3b-4cee-b1d4-ce93fb415bf7", "comment": "Malware payload (Formbook)", "value": "b80ebbebdafe06a1cecbb05c37adcdc9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653855, "uuid": "3d4f753d-bcfd-4654-828b-8af05410dbe7", "comment": "Malware payload (Formbook)", "value": "c1353defb366e521c4762686f72261bf1560d63b9ff11c3c169e1352364cc7ba", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653855, "uuid": "1375513a-b810-4f0b-9629-d97f1c0ab82e", "comment": "Malware payload (Formbook)", "value": "113f6e1713b7f7ffcbe804f9af35bcad6a45efbf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653855, "uuid": "2be26155-002d-49a9-880a-c67d10288cd2", "comment": "Malware payload (Formbook)", "value": "acba0e30034d8c3edd101e1e7aa236bdcd2e86004a14baba520d36c403fa7d696f9cb18e0d0b5d94ed665c846505f91a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653855, "uuid": "eb635354-585f-43c7-ac8a-da5b5dae6fc9", "value": "D5142317633DB4C23F8636A5BD2F840CB4BAC7AA3E995B4B27315D6085101ABD7E1783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653855, "uuid": "afef1648-21f0-4a41-9617-830327f325d2", "value": "3072:5rzvlO8eZzmMr0gtbn97zFloNXViiTXCovzmpmhapDYdW2ruWRY4oKLng:/h0hVzboNXtyoDhm0dWSWKbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653855, "uuid": "2833cf84-c130-4bdc-8111-b5692ff424e0", "value": 206963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653855, "uuid": "595fb982-af42-47e6-9334-936601b18c03", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653855, "uuid": "cbd95f58-7bda-4272-89b5-f51a8b40cb51", "value": "Wire_receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7be3dd3-cd1c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623680932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680932, "uuid": "a358f263-6f6e-4b62-ae1c-9305798c4580", "comment": "Malware payload (AgentTesla)", "value": "e27bc04459508aec01fd56b6d97cc8f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680932, "uuid": "269afdb6-ed40-48bb-9dd6-de956fd5fa31", "comment": "Malware payload (AgentTesla)", "value": "c18374cf7e46501dd7cc24f5c85459ee9ff1c5be6354cc2435e10b7cd14a79ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680932, "uuid": "506099c6-5a68-499c-9532-8cc293ad95fb", "comment": "Malware payload (AgentTesla)", "value": "79622e16f6e24d6201524d13006b3e0841ca3d01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623680932, "uuid": "11a2c263-a6f7-4a56-a200-bf2e89e2848d", "comment": "Malware payload (AgentTesla)", "value": "6c786de89767ca4c9c40a9adf60db9461bce70276e0a14ba2ab1b5433307f701b38bd58a439cddd82736737f2c896a1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680932, "uuid": "6f0af8b4-7037-4cfb-a414-00f9b29eb14b", "value": "8025012466449B62D17D87FE04A1540113F1EE17E732DB4EBEF9B1E61BB2B820673683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680932, "uuid": "a2adcf5a-2d94-41db-833a-bf2104252c6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680932, "uuid": "7aff7bc7-ed6f-4f58-8e3d-9570bb2eb9e7", "value": "24576:DOXbdhELuYA5O/iTW/chpDYZ/AOFqpGlBMMSz9ST:DMbdhLB57TWSpwAOEl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623680932, "uuid": "635ba657-6a88-402e-b16d-744c9249a469", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623680932, "uuid": "8b65380c-5c84-4d0e-af18-e8e051ccbccc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623680932, "uuid": "d136a293-bf64-4ac0-8529-9bc96912e9bc", "value": "e27bc04459508aec01fd56b6d97cc8f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187d60b9-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623647111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647111, "uuid": "953d34db-c624-4fe1-8be9-a4c464146167", "comment": "Malware payload (SnakeKeylogger)", "value": "0d9e004248567bf045a2fb05c00261f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647111, "uuid": "1f7fde86-a5fa-44fd-bbad-4d34fcb6da90", "comment": "Malware payload (SnakeKeylogger)", "value": "c2d1f5494d37cd229d820b263c934eba39bab86570c54e207730d1c84de98393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647111, "uuid": "ded02754-3ae4-4936-a155-07892f41dac5", "comment": "Malware payload (SnakeKeylogger)", "value": "962a131a0e7850b7485cf54fd1d5620ccb3b8a1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647111, "uuid": "6a42460b-ee76-4218-9fe3-09ac7b5f3d4a", "comment": "Malware payload (SnakeKeylogger)", "value": "d9d459eecac8eeda71acfe50eb3ca72d2b500a80f476b710c3d884f4e21e5e65afc112c7460d5945a9aa567edb683658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647111, "uuid": "5d97fc25-f019-4dcd-8c40-4e0a8ea3938a", "value": "8CE4123C4A802FAEC2DAD57885D085010BB8DDAAA72FFB4CD48275795A333F50AD1D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647111, "uuid": "a40e7ce6-740e-40d1-b75f-e4f9408891bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647111, "uuid": "b44b7086-e351-4413-8e1a-eac83362998f", "value": "12288:9xaZM4e/ZUdtbL/hg5Jjp7EN9fSDfYQ1CWb/6hd7yKPC3PcwpH7ftdiI4OuZvGOn:WNeBUdt+TjpYN9ufDb/m5C/cwpHhdX4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647111, "uuid": "609f4cd0-f1a1-4754-8d13-106c0f4f9f67", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647111, "uuid": "5b999f57-2a41-473e-8111-c203ed593eb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647111, "uuid": "afb53162-e0d9-49f9-b631-b5261e91995c", "value": "Receipt_Dhl_000010000000000000000010.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6439f0-cd15-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623677774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677774, "uuid": "5bfa3dbb-489e-4e02-8dd0-89bb045a3323", "comment": "Malware payload (Loki)", "value": "5aeea5d1bd93be27ab4cad10dde05cb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677774, "uuid": "66e58982-d2c2-46eb-8cd1-b0bb4fb3965e", "comment": "Malware payload (Loki)", "value": "c4c9f37709fbcd3769b2c3d3d70c0710b7b1447c86ea1b12e54d89e3826a7cd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677774, "uuid": "db439479-f9fb-4003-90c2-ccd4942e546c", "comment": "Malware payload (Loki)", "value": "95c9d84b3625db165809d42a6123be9a5b5c879b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677774, "uuid": "27f0e47f-ebcd-436b-9874-4e04c5233431", "comment": "Malware payload (Loki)", "value": "7d034aa4c8e8edc0a1b4196735b6f3f9a88a7547f08118978f889b5953a2c7c38bbbcec73c8a9935c29b122f54355149", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677774, "uuid": "3907ce0c-2fbc-49dd-adc2-460c55072155", "value": "B7355B9D3650B2DFC857CD72CAA81C64EBA0747B930BD643906316ECAA4D99BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677774, "uuid": "6dc67733-01dc-4bbb-b4d2-a3aa3dca67b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677774, "uuid": "9dbbdafb-4fd4-4de2-88a9-512f3f9e5736", "value": "12288:h6nvrKQLM17DTTLM0pNmf4kmApeIEMEwMYk/2g5xhbWpYry8sXj9VCZ6vmxnR63m:hivro17PTLMimfq8r5MYkug5f1rM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623677774, "uuid": "d0ba50ab-2c4f-41f2-8679-c1279bf8efe7", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623677774, "uuid": "08d8aa1f-19f5-4b2a-9f44-b59a584eb6e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677774, "uuid": "eede58e4-577e-4fed-a159-668c79edc469", "value": "5aeea5d1bd93be27ab4cad10dde05cb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce4f1c7-ccfc-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623667009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667009, "uuid": "cf04e3c0-6665-4e21-88fb-395131c11f85", "comment": "Malware payload (BitRAT)", "value": "8cc968483745474bde038c3e0f837c1e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667009, "uuid": "2ef511ce-313e-46ab-9730-aa151c59dc98", "comment": "Malware payload (BitRAT)", "value": "c4eddae996c1704f9a4470ed2f591b48c25e0a6bac1211c897ef7012f121fd23", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667009, "uuid": "c1f1c4cf-aa00-40b8-b95e-a6098853de94", "comment": "Malware payload (BitRAT)", "value": "364b5066e7f3cec1f34379d021e738655c444bb5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667009, "uuid": "de37dc8b-00f4-4416-bdb7-4a326b0b6945", "comment": "Malware payload (BitRAT)", "value": "f0e0856043ce001c6a38f35b72eef4b08c0239fac99efa6b7e74535b0c16212a348fd59e68b6ca398379fe144f3ddac8", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667009, "uuid": "84b2a4da-ba74-4c7d-bfe3-2ebb40997bac", "value": "C2753321BECF42B8C8D35EBA8CE55D38A17637C481274ADE2D4CE5692F1392F2115B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667009, "uuid": "67829268-3277-4e1b-82fe-d2e84c0d5225", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667009, "uuid": "c2ae0426-bae3-4310-938d-4ffa336a9284", "value": "24576:QXrj/Az/WeTnlQWErmvqrbvG1FJJcqlYKMrJniGLgxgXVhOTIoINlECBHH83LM:0rDAzu3rmavyHcqwh/yg+8oAHH8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667009, "uuid": "1b09934e-716d-41a7-acbc-e703df26c7a6", "value": 1666048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667009, "uuid": "6a77676e-6079-451a-8987-4a6eea8a9a42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667009, "uuid": "77d0a741-b782-4ccf-bea8-dba5294ee30e", "value": "SLIDECATOLOG.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91866394-cd15-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623677808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677808, "uuid": "47f153e9-91cc-4823-b9a5-65eea735184c", "comment": "Malware payload (AgentTesla)", "value": "50e4ba80b4a8f3aac01dbe9107e4ce66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677808, "uuid": "b5fde8d8-8dd8-4356-8f5d-1d12effc3edf", "comment": "Malware payload (AgentTesla)", "value": "c5272e2706630daee3f00e3942e72108f1a3c967047d46e05eb62f6b66075e43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677808, "uuid": "e6c45c34-0beb-41b5-9ee8-05735649728f", "comment": "Malware payload (AgentTesla)", "value": "8e9d505287c3b49abb4298375b7b0a31a2f82b79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677808, "uuid": "48fcfbcd-d096-4228-bba7-823c74df6825", "comment": "Malware payload (AgentTesla)", "value": "e8258fbd1cbd49c58751e3ef70dc1b210aff540c0b5332f9ce574bb161694837ac009d7ec999e722146178a9b0ff3b19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677808, "uuid": "d2a3dc72-2d9f-4c7a-ace8-67fcb7efaac9", "value": "E7242A5A6315D521CB6F527EC016820831F1D703972AE38F5AA5D8EA2F836CCF90BDE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677808, "uuid": "c6bb06bf-e92d-4fc4-8f85-ca4290f480f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677808, "uuid": "a7a94b79-1ede-42de-906a-be01fc2dcbe0", "value": "3072:nmQ09zAf2WP4ystFUvcCAY9mjaSOwr/s3RlMSLqnLSOHPI1rAT/UYUgaU:nwm4lUy+mjvdE3HmnOOHQ2xUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623677808, "uuid": "50c35fd2-fe11-40a3-b713-79cb5b3ceaf4", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623677808, "uuid": "fbe9ea85-d61a-415e-b09d-3697b7bb8f59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677808, "uuid": "c9ce5633-c35a-4420-96e8-e1f26debf72e", "value": "MGJMJfWcOlHYGCsdlWbhHsPUysKpteyohndxgT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de6ece2-cd06-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623671172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671172, "uuid": "faa1ac3c-2a9a-4796-bbaa-1f7c183bd801", "comment": "Malware payload (SnakeKeylogger)", "value": "63bda49683d33e9e98e46a2abbaa845d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671172, "uuid": "116d6610-9933-4bab-9aaa-37ad247f900b", "comment": "Malware payload (SnakeKeylogger)", "value": "c66e2c74b65548e9de45251ae3cca3f20e9fd3c4acf4a8005683be4ee5de981a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671172, "uuid": "1c71eb84-634d-478e-b1f6-b625c0121b93", "comment": "Malware payload (SnakeKeylogger)", "value": "9a0d3120d33740ad2763f1e4d630725f383b820a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671172, "uuid": "b35e3729-cd25-467e-963a-ab625e182ace", "comment": "Malware payload (SnakeKeylogger)", "value": "cf0d067dc9bf361ae7335eacd9330093347db027faf52cb9f4e6313bf1af3370c4702b8b1d28cae85b7cc5fe6bc58bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671172, "uuid": "a0879ea3-9f24-47fb-84f7-e099aa3ff31e", "value": "77A4F11121D0D95AE8EC7D31B9E6C2790DA17CB414F03A6763E4FA1B297509FCA0FB89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671172, "uuid": "073d5740-3efc-40e9-96eb-05458df619dd", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671172, "uuid": "6c102921-aa9f-49e2-848c-fd57d663718b", "value": "6144:1sCVDsrxvcbtdkYSNKtGmQeI4xkEggSQEdQI7uYcVZpAbiiOnohJr+idO4GW0baM:2kSQtzxFggSQAbAHAbGnoPrLgWVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671172, "uuid": "8a5af57e-7d2e-49e3-b574-06c55979a209", "value": 493628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671172, "uuid": "e4686c5c-6d88-425f-9d1b-295b45c5496b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671172, "uuid": "23e4bac7-22f9-4c0d-9bbd-0c00fbc771a4", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a51780b-ccfe-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623667703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667703, "uuid": "81e0777b-af46-4f7f-9a3a-42563bcc8031", "comment": "Malware payload (Formbook)", "value": "bf3793e8642b791d228851dd381c3090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667703, "uuid": "996b576e-d916-43d0-9cae-99e74c0f2c0e", "comment": "Malware payload (Formbook)", "value": "c764bf06209113f83fe298495818adf186b5746c299ac93aab0d8ff4f080626c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667703, "uuid": "f1064832-b303-46ab-a740-4c984416e66c", "comment": "Malware payload (Formbook)", "value": "3011e231d78c6e5262a1b043c6989b36261bf6a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667703, "uuid": "a49b64b8-0913-4d42-8157-bd3e8db05d15", "comment": "Malware payload (Formbook)", "value": "3b272ed01af69079560400e6069af391e0a24f3a40eb0ab288ceefed7d92af206f66434f68f068e1db85bc0078b64ce6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667703, "uuid": "28b3454a-6a46-4de7-bee1-953f5dd4e71e", "value": "C2A401DA49F9C67BE85D4A30497AFF254E789FCC3702260BCB94BDAA3CE63C66440411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667703, "uuid": "9b02c811-c325-4196-b07d-e3fc8e289b1c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667703, "uuid": "0eb87cde-46b2-417a-84a3-cf065fdaa803", "value": "12288:gWBO4yMNza0PeenAaswNXjQO2z3Ob6J/7w4q174:vOue0PeBasuXjQO2z35GN174", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667703, "uuid": "9b57a604-0076-4ee4-8905-2326c9d3e7f4", "value": 472210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667703, "uuid": "fadd40ff-5d6c-4542-9ab9-863d9ca500ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667703, "uuid": "45865d5a-24ee-4c7f-86ad-5b7ce2298a9f", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649cd797-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623658835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658835, "uuid": "d8e86378-c09e-40ca-b00f-e4bae2593274", "comment": "Malware payload (Formbook)", "value": "61140b8dd0f45f5920df3f2a0efaab85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658835, "uuid": "f6dff192-156b-4939-a230-66900e2b56e7", "comment": "Malware payload (Formbook)", "value": "c78f3f2b625c15d32603674847f55476931893c024fad6fccd61c9916ee32528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658835, "uuid": "1ce5fa24-e15e-42ae-8e44-c5f4b654f2cd", "comment": "Malware payload (Formbook)", "value": "9f0a959da5bdb163c4abe45ac4c4fc79e63b8d22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658835, "uuid": "b2a5e80d-7a6c-415e-afc4-ff91ba83094c", "comment": "Malware payload (Formbook)", "value": "40443bc2bc85d9b3b412f7af756b90a5ab05b8862e2393532a6e3a40e5c4eb5fa806cd6720ea74136369dd0079259c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658835, "uuid": "8ca705e7-b464-401b-86dd-0c169d5498cd", "value": "56241274A6D15837E2169A710977DB72D2F7A70123512F9FA7B01FABAA600C385072CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658835, "uuid": "2033451c-11c3-4eb7-a977-71c8afc5ba90", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658835, "uuid": "75db99ab-9d44-441a-b9fe-2e80d1fbfa55", "value": "6144:Ds96aPNRLkWgS8U0E3DjgDoWZ8Hsya5vNvKCYGj/:yBEJS85E3DjgDoWA3gvhfj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658835, "uuid": "ed6dbfa0-4416-4e41-9de3-fd59940ec60a", "value": 219492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658835, "uuid": "62d0e135-052e-42d4-b5b5-e039722e58ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658835, "uuid": "d88ae2d7-af4e-4c9c-b024-0cc774d08790", "value": "61140b8dd0f45f5920df3f2a0efaab85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5c9d7f-cd21-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623683059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683059, "uuid": "94bf4139-aa79-4a4c-a73f-263f9f5005de", "comment": "Malware payload (Mirai)", "value": "de79d4fa1e2e69f8144d4f6e170efc4d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683059, "uuid": "8ee131f3-743f-4479-8559-061d3a49850b", "comment": "Malware payload (Mirai)", "value": "c80d6e522ae244da4887623c31cc5e44ad4068b1cfe8acd7c80319dc8c18d4e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683059, "uuid": "45e92324-ce2c-4ccf-adfd-a5ab879d6f65", "comment": "Malware payload (Mirai)", "value": "1c225c0225dd7f39fed73623162b4f0d387bdbe9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683059, "uuid": "78e12310-72f2-4ca9-a5e9-518a4a4672e3", "comment": "Malware payload (Mirai)", "value": "7aa9bd8b69f002fefd3274c4410391e09d3aacd13a01a7aef07a59eae8552d4f3eee283de92196115389c615412a1aea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683059, "uuid": "c9fc522a-023e-4c2d-b76a-e237318ee74f", "value": "EA64E08AEE01AF25E9C016BAFA5F034973774B6CD3DBB111E620CB2936CA55B4F76044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683059, "uuid": "b58e1661-983b-491c-9270-09e0362ecab7", "value": "6144:p3lOYoaja8xzx/0wsxzSiX99zBa77oNsKqqfPqOJ:p1CG/jsxzXX99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623683059, "uuid": "7ad520f0-82a0-4aae-815c-3f0199ddf207", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623683059, "uuid": "e3f238a9-da8a-4bec-b8ad-3e3f9485936b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683059, "uuid": "b5a87d6a-1864-4063-a9c9-0c84071a856e", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1593e0-cd1d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623681074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681074, "uuid": "497fc792-9f0e-40a5-bfe2-4f5c1e3f21b6", "comment": "Malware payload (AgentTesla)", "value": "17ef0a158930e9199f3688b214c56144", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681074, "uuid": "6372dcab-3e85-4571-93ad-5ba2759c33b8", "comment": "Malware payload (AgentTesla)", "value": "c86b96ac80c0bcd3fbf21303dea304a346bf50e6a6a096003e697bc9542c28d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681074, "uuid": "ee685569-0fa3-4348-be52-d8af1209789a", "comment": "Malware payload (AgentTesla)", "value": "2e2e91f61cab09371bb04731cde3f3ddc642db0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623681074, "uuid": "6302987a-9a93-4f20-9967-a2c06f87f0a3", "comment": "Malware payload (AgentTesla)", "value": "2e076ca50bc20d658ed9585597821cb374cfa7f54a40e1e63dcd3f814e3dd3a23062c7ac155af55e4064f717d7011330", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681074, "uuid": "d3097cba-3e2c-48aa-94ab-489cae5dfb34", "value": "0C05F1AC712035EFC86BD075CEA81C65EAA47C77931B4207901375AEAA3D987CF644F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681074, "uuid": "866b3a49-119a-4718-a31b-3884b4e3e6cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681074, "uuid": "4d99ce22-523f-49b6-8538-a7b502106f2d", "value": "12288:0ZM4e/ZUdtbLDwwbTn8jndz9SszuV7asA+3RRXm3AvcxIbfWOrpIdgWMSd6w/6oB:0NeBUdtbXz8jndzBzkUKfWOrpI/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623681074, "uuid": "67892b25-29e5-4434-8bbb-5335519db032", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623681074, "uuid": "94981d67-b17f-40ce-8c9c-cfc1e6cfcfbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623681074, "uuid": "f942b501-b2e4-49ff-9c8c-a519511bdaf1", "value": "17ef0a158930e9199f3688b214c56144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8998f29-ccec-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623660345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660345, "uuid": "1d638cf8-a717-401a-b314-7dc46eca8c8a", "comment": "Malware payload (SnakeKeylogger)", "value": "5cc471ecbfa3b976255ace51bbe175cd", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660345, "uuid": "c8f41204-24a9-4fa8-93b4-542ded9e9e0d", "comment": "Malware payload (SnakeKeylogger)", "value": "c8a709c2472a4e130bf04111bda50278fd31c27986d969ecd75d9efe1669f72e", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660345, "uuid": "93f394c8-7d0a-4454-94f0-98ff8262e152", "comment": "Malware payload (SnakeKeylogger)", "value": "b91249e3f803d952b16611227c5ab99aa7ce3a5b", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660345, "uuid": "f60960f9-a63e-4ed8-b8c5-f9ec42a9f9b4", "comment": "Malware payload (SnakeKeylogger)", "value": "92f7367f58822095ba9ac95ceba59badd79e6618ea1ba8ddd39aac199eca778d37aaaff8ba4d72f27813c9ca37e4845c", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660345, "uuid": "ed023f6f-b6fc-4f9d-9a3c-73fde0827cf8", "value": "6334230FB036DA47D5A8F2ACB87B411CD9A36D040395546E8C04FDAB6C1BF32FA91B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660345, "uuid": "ce4566e3-cb78-4e86-8d70-3411e8553528", "value": "6144:uc72SBodgDqQi7YqJ1MWe/bTUQLPyRExkpAuF1Vno:gStqQin1MWejZjoE6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623660345, "uuid": "2c733d67-aee2-4afc-8e0f-83bcd66cb25a", "value": 249001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623660345, "uuid": "43592dda-2f34-4e6c-adfb-352d6568f486", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660345, "uuid": "891d314c-faa3-4bc9-b05a-5bd8c5c69e63", "value": "INV 8462924546.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04eae8d-cccf-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623647768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647768, "uuid": "1cb45747-dc2c-4789-86a5-04753d0e749b", "comment": "Malware payload (NanoCore)", "value": "9b8c662fe7de00d9ebda89b810a6cc22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647768, "uuid": "1a98874c-03e0-45d9-b6af-dbeda92d6e9f", "comment": "Malware payload (NanoCore)", "value": "c8caecb66c3ecec7ed4b59a0318e81eae655a8536816be0b16883e1fe51e6707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647768, "uuid": "1c01e3bb-bb5c-4f5e-8024-3cdd99dfd3cd", "comment": "Malware payload (NanoCore)", "value": "30e9d72105d2f7c7f23cd2c5939dc8525a02c848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647768, "uuid": "e1f3d757-8714-43c5-8493-3b2aa84ac082", "comment": "Malware payload (NanoCore)", "value": "8832ddab185f276941253a83dbaba81f764bca62de85eb63ba043fe64a2010423c4b3ddd5919e1a6328ed0131a8859bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647768, "uuid": "c4b926f2-b017-4bfc-bcbb-37ad45d5b1ec", "value": "0C15F1AC721076EFC967C136DAA41C64EA647C76431B5217902374EEAE3E987CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647768, "uuid": "6cf52bf0-8fed-49d2-8f84-c7ed478d915a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647768, "uuid": "c8425d0e-28c3-4885-b6ee-3e3f8ea4ddfb", "value": "12288:WzZM4e/ZUdtbE7OCPjapSQdUZT6kOpYaXIebFsxTixPEgYkfbQ/CP4msye+mF3zl:6NeBUdtw7TPjak4Am7Za3YcUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647768, "uuid": "6d88bc7d-d98a-478f-9bf2-dddf9a30a947", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647768, "uuid": "68673808-6b98-450d-bcf2-a4c10e441805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647768, "uuid": "a5116e4c-2b14-428b-bfb9-4c5c8bdc2a65", "value": "Scanned Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ed368a-ccd5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623650188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650188, "uuid": "a8033d69-d953-4fc9-924d-46635fa0d8dd", "comment": "Malware payload (AgentTesla)", "value": "de6fa00fb9b08d48b76272b35e12ca9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650188, "uuid": "9a384e10-71a7-4be5-8f45-1e0b3e2a265e", "comment": "Malware payload (AgentTesla)", "value": "c9077a0f2103b11e5f8d2b02cfdb74585e6204aa1403bda8827670da16fe0fd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650188, "uuid": "eb15582c-f3a5-4641-9801-9bbf37414865", "comment": "Malware payload (AgentTesla)", "value": "0c0105edeba02e7822fd358b6f363f1eeaa05cf9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650188, "uuid": "fb05196d-404d-46e9-85de-067d736399ac", "comment": "Malware payload (AgentTesla)", "value": "e58dac60649d928bf48620190f0e76a349c3b9111c5f81525dc7a5e5955c0f174ffa8431b9a3571ab753357fcb120fbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650188, "uuid": "bfcdb10e-0130-4585-bc0a-b2a34112c5fb", "value": "C91568F592E107CBC3AEEEF017D5B3808B6F66A671349114A94C22EC67ED68D41CE217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650188, "uuid": "3e96f0ad-dd1d-425b-8780-bfc9a84dfce3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650188, "uuid": "76be77c3-d46f-43e3-ad37-805f111e70ef", "value": "24576:GMDTC4O2DfjX1CEbySGvLHXTE7RNeBUdt:3a2DBCz/vjDE7RwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650188, "uuid": "4ba13679-15c0-4503-86a0-52b7f1944cb6", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650188, "uuid": "0da8a2c2-3bcd-4bcc-b7ef-f13d84cadc0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650188, "uuid": "81351a97-9561-48b3-b367-e2a97b1b2d07", "value": "kzSbt5QDWBOFOiG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840a4eeb-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623653734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653734, "uuid": "7d10c80f-7cf7-4f8c-8b33-9f1acebed0aa", "comment": "Malware payload", "value": "b1102beadb8a57af7c1122c697a05f0a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653734, "uuid": "ca98ab6d-60dd-45d6-b911-c53165a3c0cd", "comment": "Malware payload", "value": "c9358fb5a3bb2af0871bddfc85c94a80fa76f1bcf2abca50343d7ab71b5d47da", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653734, "uuid": "b21ccd11-94b1-4208-ab6e-ae371191f9f9", "comment": "Malware payload", "value": "b434d7c210834ed7e0113f5c81e82157eb39105b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653734, "uuid": "0f99af2f-9214-4e38-9059-e1a0f298496d", "comment": "Malware payload", "value": "7ea88801bc0b59d430e14a42a3478cdf18d8a555608e81d1887348339f447aa5585196f7f4349e84990d51c89f04d076", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653734, "uuid": "38305735-1c9a-4ad6-8511-89a5674e2bb1", "value": "2A51FC201AE21798E27257365FEDF276AA72F865F83DDF7E410092808627840DC70F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653734, "uuid": "2238f388-f0ad-4fae-9019-1a72b3088224", "value": "48:8WZlBHpmnK0mPb+E85+a/eW6ao/pEgomaR20w:8cBPlw56BCg57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653734, "uuid": "4989bf9c-86a8-43bd-8a5a-57f9edfa70cd", "value": 2533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653734, "uuid": "bc4bfd9a-3ae4-44db-841c-65e0ea4abdf2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653734, "uuid": "9394ea3f-58e3-4444-adc3-980b1d4b7137", "value": "Image002.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7438b6-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652350, "uuid": "2878b12f-6cba-49dc-8905-1e56d4b1d2fe", "comment": "Malware payload (Mirai)", "value": "049ec2f746b97291452ed292a492532c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652350, "uuid": "1886d26c-d0fc-4424-8927-32e909ca03dc", "comment": "Malware payload (Mirai)", "value": "c9dbbc8a8130fb8d608460c6a2f08fdc0f7630955334b5541929df44d7b2cbb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652350, "uuid": "74615b87-16af-4dfc-af1a-2d627dde5cf3", "comment": "Malware payload (Mirai)", "value": "4a073bf29aad4f6f2b2283bcd94779e8fdca83ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652350, "uuid": "d0f6969e-a6ce-4ee6-ba60-2daaaf2933be", "comment": "Malware payload (Mirai)", "value": "83826f9d546938772f68d563b14f0992d46ba301f7d228b9784c4937cecefdc702670398907853903346df2d40ad9e9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652350, "uuid": "4df65560-85e7-4344-ba43-a509196bfd93", "value": "D704F7CFAB180283D4EB45F1396737F9479DBDA102D61289A60AFED40733AB52821F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652350, "uuid": "98dc2b72-5f0d-4113-af11-a23e81657020", "value": "3072:hfTaZvja/op7Srup4eMPdmA5Kw5dHLF1FYpmq0ncOLgbaBM3K:hfTaZvm/op7Srd/PdmA5Kw5NF10mq0nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652350, "uuid": "936996c6-0ebc-463f-8f5a-5a46b0610a8d", "value": 174978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652350, "uuid": "7a122af3-cbaa-4dac-b76a-1b2c190b32e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652350, "uuid": "80b2cef6-7592-43e3-aef3-41590cfc86b8", "value": "049ec2f746b97291452ed292a492532c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714b025d-cd15-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623677754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677754, "uuid": "9835ab9f-f66e-48da-8bed-61f72c37531f", "comment": "Malware payload (Loki)", "value": "2f86f964230b65273933c21db2003b48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677754, "uuid": "2e7eebfd-e260-4b61-9fa3-49a38d49f7a8", "comment": "Malware payload (Loki)", "value": "c9f724802e51ee6e46a0be83931cbf165d453c4fc4ed6bff967d37854492a241", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677754, "uuid": "e40625d8-07e2-47b5-8d05-472ee0371586", "comment": "Malware payload (Loki)", "value": "4d28f76b2c337180bd3e8263b8afb540140f7ade", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623677754, "uuid": "1afa23bb-a964-4852-bb71-1d89eda80b52", "comment": "Malware payload (Loki)", "value": "076949a5649f4b6a6f204b609399d9a93c56405fae0bb75142689b47de22c66330184082745319e01ba2880e9062ad60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677754, "uuid": "85c4aa92-3dd6-4a52-ad2a-842646c48724", "value": "61356A9D3650B2DFC85BC972CAA81C64EBA0747B830BD703A05715EDAA4D99BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677754, "uuid": "1ee3ae8f-919e-4cab-8aec-69e9e8fdcfc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677754, "uuid": "73bdcc69-e5e5-4512-a82e-f2a7cc65ef5b", "value": "24576:u92erPibTLMB3cfdq4VeZBZpfZtI7pRDX:E2WqXLCsVqzHbctR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623677754, "uuid": "12e435ec-8987-4270-a58f-e7589e2a5c6b", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623677754, "uuid": "40ff50d1-4463-41d8-a81b-172f90e0ab2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623677754, "uuid": "c1d61142-0c2d-4a68-aadb-bf443e7fac6e", "value": "2f86f964230b65273933c21db2003b48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66aaeac5-ccd2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623648960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648960, "uuid": "cedc1d22-5ed5-4bb3-a219-f8f382e15dd2", "comment": "Malware payload (AgentTesla)", "value": "c69ee8c77e0f82cc7fa5235d67d164de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648960, "uuid": "ac2074be-d929-44b9-8fb4-1ae742418668", "comment": "Malware payload (AgentTesla)", "value": "cb91007ee0220d30de02d0ff07546aae9d149cefd5c5780a6f8fa3601cd1138c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648960, "uuid": "6457a75d-4919-47ea-ad2c-07e7f48814d1", "comment": "Malware payload (AgentTesla)", "value": "07dcc6d6dda5f7a37af3254f2a81d2e94d98c562", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648960, "uuid": "fcf695dc-222c-4da3-bb27-187f4bea0192", "comment": "Malware payload (AgentTesla)", "value": "1c029e6c02724fda024935d3255ea9a4b596d01560b8dc5ca858d9b7f263736d42b208496a62109650f1506ea425bff1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648960, "uuid": "3c1cca2b-72ef-48b5-80e3-5dd2389146f0", "value": "27A402043BEDA129E1366FBA96E4A741EBB9B4737A07F18A2481274F0A13F44CDD1635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648960, "uuid": "3d6437f9-77f7-4eb9-bdbe-724d70583e08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648960, "uuid": "eceb29e3-8494-43c3-94e1-f988dcd70eb1", "value": "12288:gItlaNuv//+9cbDLJ8eQ9F97PUxs8dHNqfgWQQR/c:gIR/NnLKeCLDIs8JNqfgVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623648960, "uuid": "839959bd-1104-4318-bf40-cc30623fe7c6", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623648960, "uuid": "1f7ad733-c045-4730-a691-966a33bddc15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648960, "uuid": "25ab7672-fb13-474e-8e6e-54e42834b812", "value": "RFQ Reference no.775643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acf40dc-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1623658899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658899, "uuid": "92d929e9-a58c-4b06-9650-398d467c26d1", "comment": "Malware payload (TeamBot)", "value": "f18c2c846ca02c25efd88e240f4054f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658899, "uuid": "c50ae92a-f472-4e7f-b6fc-4a6d4f741459", "comment": "Malware payload (TeamBot)", "value": "cbc8c53b7e19241457a0d54139406edbe7e778f59c079d7d7cc39e44b83131e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658899, "uuid": "985dc00a-fa77-412d-8944-d7c864ae18da", "comment": "Malware payload (TeamBot)", "value": "5d375e78e61b764cfdda4012865af3d652233198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658899, "uuid": "50a14d3f-0670-48b8-bc87-14f1854540f4", "comment": "Malware payload (TeamBot)", "value": "27e7bcf6887e643c884928444a5d9293a6036301671311dd4b122787366201c81cda489658f277b295aa10faa540355d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658899, "uuid": "a9b79364-92ff-41f0-a1f8-372e9c5dc115", "value": "8505010037A1C0B5F0B716F96A769EBAA6ED7D715B6860CF53C566EA23346E06C30703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658899, "uuid": "2587030a-4b0e-4da7-918b-2882f9c199b6", "value": "f3b31e907320cadf5820c6eb76eca851", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658899, "uuid": "569bd264-2b72-4052-ae71-4852d4a094bf", "value": "24576:EJt2WAOxiT/aeXSFtQn4vZpXHKK4sgKa:Ej2kuaeXk1VHxgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658899, "uuid": "06470bdc-2761-4591-a443-e221e12aa6c3", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658899, "uuid": "037b573a-9a73-4f3d-968f-c042f80d0f76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658899, "uuid": "f15dbab5-1256-4432-89b3-9dec0d7f87da", "value": "f18c2c846ca02c25efd88e240f4054f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e535810-ccdd-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623653643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653643, "uuid": "a632f812-b557-432f-b2db-46eafb24f547", "comment": "Malware payload (Formbook)", "value": "2892d90f2ee7e9a38e5acf42d283e64a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653643, "uuid": "659400f3-40ad-4479-8268-76868082645e", "comment": "Malware payload (Formbook)", "value": "cbcdd62f7be0873045435fc301fc15b57b17e2e29801cda1b884d24909f68be2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653643, "uuid": "ceb648d7-9bb4-4574-8bd8-981d55f1c258", "comment": "Malware payload (Formbook)", "value": "6ee4d0869ffd18ae0e88838055e45d94fb7aab0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623653643, "uuid": "66f90365-749d-42a8-9878-583c478f0ef1", "comment": "Malware payload (Formbook)", "value": "ac6e962d294e572fa1327dab5ae9ba5bbe76f140ceafa596830173f6f9a4fe8c69f55ef8da625b36c07777d033efcfb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653643, "uuid": "13517467-dddd-46d9-b430-9e69540fd170", "value": "9A156CF8F1A898B1C54EC732C691DCBEEB211DFD5243092D05B9FA8D6A3378A9F58444", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653643, "uuid": "9165be0d-e76f-4e29-b7cc-3deee8ed72dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653643, "uuid": "801c34ae-2c31-43f2-a6d5-875d3750337a", "value": "12288:q8CvT2pzknbcq7D5ha4bXdu5L9K2IuUkM9WBH9W6v7I/6skpBEk2RScf:qQq35hPXdg5K2IuUNuWgRskXEJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623653643, "uuid": "2aec64a9-e6e8-488e-a5a6-d467fb28279a", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623653643, "uuid": "3cecd333-f11b-43ff-b559-d70cb203f51c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623653643, "uuid": "a275d5af-3eed-4ec2-bb14-19a3be81efca", "value": "PO#X2021-621.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1a3f03-ccdb-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1623652945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652945, "uuid": "8db4ca35-065a-4e28-844c-1764e976faa5", "comment": "Malware payload (Adwind)", "value": "fa0c05f2cec877b5dcc87e6cd2070389", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652945, "uuid": "1ff1fb43-1296-40d8-b083-c4b8e0eb25ab", "comment": "Malware payload (Adwind)", "value": "cd74d0b9dcb08225142999b46044133ea772dfeb122ff89066bcd35d19005790", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652945, "uuid": "572fb245-55f4-4f4b-ba13-a581541ef32e", "comment": "Malware payload (Adwind)", "value": "c02abf315efc09ab8f1944a2f45a326623051c96", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652945, "uuid": "77b94e27-432d-4b0a-b854-6bc9fb788bc1", "comment": "Malware payload (Adwind)", "value": "0697e00f27d7b4d8036354e47d2bfe71591fb97253f43c4e0c4e8fc3a525f3b3993d5f38134c32da85e9ef4246109294", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652945, "uuid": "56295661-05a6-4328-b244-1851302ccbd9", "value": "E46422C221E5E438C4D880362AB775683349FC922B008B7DE9E8565EF5F9F49C9C9DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652945, "uuid": "8fb9b2be-5ba3-4d31-bc20-5bc378b280cb", "value": "6144:VFA1aPW/KNnmtilJrGWwSQot6A7sTEwLGcFFqe0NXMuvGdShH+okAWb:Vm1fKNnjPiEQI6bEwLGAF/WXMCT+TA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652945, "uuid": "a4707d8f-7631-44be-84ed-ad600ea3e997", "value": 320419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652945, "uuid": "6b6c32bf-9643-45a1-ba7d-27ac4042a2bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652945, "uuid": "e476a34c-247b-4f70-bf7c-6285eda8d040", "value": "n8OoalD8giLjp1mOZaYe7DMw.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0fc391-cd21-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623682951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623682951, "uuid": "2cfc73f2-652b-4519-ab16-090cdf793fd8", "comment": "Malware payload (AgentTesla)", "value": "7dbe1c99dd91f99781d23475e9139c9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623682951, "uuid": "f963f95a-ac10-4d4a-839c-50d0477ac438", "comment": "Malware payload (AgentTesla)", "value": "ce09fdf4dba6bf79b04a7b958ce616136660fa20e6263d13ab0a74b70062a34b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623682951, "uuid": "a642d06a-41ea-497f-a34d-e3030d696f45", "comment": "Malware payload (AgentTesla)", "value": "0a37ec466be63554d08cc043a4a71dbe1ea6d764", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623682951, "uuid": "ac050b0c-72be-4d74-b14b-6e606fe6f76d", "comment": "Malware payload (AgentTesla)", "value": "9863f8f3df71c2ce3655be29ec7e0ea56721a06b8e2cdbaad6c5e31e1c25f5fdc74284397281aa722f93bdccca046053", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623682951, "uuid": "13fd95a2-960c-4833-a0ca-607b9005d01d", "value": "1D84234EF8C5486148D3C8FD9536C251D9FCB08D24F4BE8AA6E7FE537C2A56984C64C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623682951, "uuid": "405c9670-2c44-4cd8-8137-0b1cea363eb4", "value": "6144:Fg4erfbO1t5qTThJ1G4rTnSgWiPlspWLAnj8vgCtodElQzY/NAsXSbDgIC7SGqD9:mHfbmMBnGksOspWUnoYCeE8sXSbDgF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623682951, "uuid": "47d63bfe-4cef-4b8f-94f0-60016ba4af9a", "value": 399148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623682951, "uuid": "de32ed50-a876-4554-9586-1d82fe1184f9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623682951, "uuid": "3e78a520-2619-4067-9c4f-d5beccb1875c", "value": "TRANSFER COPY FOR SHIPMENT FROM KOREA-PAYMENTS 883-725-990-0000.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9b4e18-cd17-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623678441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678441, "uuid": "c7ae06a3-d888-48c8-8f44-5d6895cb5069", "comment": "Malware payload (Loki)", "value": "57f5c88209e146bbc8e2c175bf4076e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678441, "uuid": "a3dcec96-733a-47e4-999a-0078ebf969a6", "comment": "Malware payload (Loki)", "value": "cf047a5781d40b7500be89db809fe4343223b20e043819bbba6511ed4f5858e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678441, "uuid": "33430769-096e-4835-8004-ef125c188afe", "comment": "Malware payload (Loki)", "value": "887bf61a289f4e70bac6c1ce88e6c9ff6a61f3c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623678441, "uuid": "9731852d-f775-4be9-ae40-024741f3c399", "comment": "Malware payload (Loki)", "value": "ee0d68adf2066f7f770d66f977f7a49c758afecb1f886ecb3e93df04aa22c0e2796668cd2a148948b7fb9483331d3814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678441, "uuid": "f37022d1-eb61-491d-b1f9-7d53d62d8f01", "value": "16D3025336D885BBF4530A322AF69F2AF3F5E710039B119FAB541E7E7925293C819341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678441, "uuid": "1ec053bb-7412-418b-9a40-f734bdac3b06", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678441, "uuid": "d31761c6-f367-4b26-9462-9c65b638684d", "value": "3072:tQIURTXJLMwCBD8qJW+NRuoz3djqRpV7cEEwrKsxUvJ+:tsmwwDjJW9oz3djqRjQIKsxS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623678441, "uuid": "4f2537f3-67b5-42f3-ab16-113cec4ac031", "value": 137891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623678441, "uuid": "f530c689-7f18-4ee5-8772-6cd32f1b66bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623678441, "uuid": "00fa87c6-b31c-40d5-8205-7ac1bcc0e3e7", "value": "Product Description weight and width mesurement and torque specification.exe.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ba1699-ccd8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623651755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651755, "uuid": "f73c0278-09ea-4cb8-a2e1-41a5dee2bcfb", "comment": "Malware payload (Formbook)", "value": "c68b967a81659df6b0fe25096949219c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651755, "uuid": "0340de38-bc1a-43bf-91ea-a77e2bf1efc1", "comment": "Malware payload (Formbook)", "value": "cf3c6547dc723e0ea8f7943cb08cd0fd7820daf0b30d1d19cb0de7a5f1b9ab0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651755, "uuid": "e7569abe-1234-4f48-932c-4e4c5a13b88b", "comment": "Malware payload (Formbook)", "value": "c205d4b961293653bed5ebf271c34f98832f0fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651755, "uuid": "a92c3c04-6aa3-40e0-bdfb-dd7ee24ceec2", "comment": "Malware payload (Formbook)", "value": "662a5b975b79356ca503675afe193548a2d92ace18d353e213189ea17eea3d7e2c65dbeb52637db015479779b3b556af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651755, "uuid": "b5a2a86a-63cb-4552-8543-c1038446c460", "value": "AAC4D03E77983BA5C1280D76C6775A9583F1C2137232F3AB2CE506E4CE12B1A1B1F566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651755, "uuid": "56e16edb-30ae-430f-842f-c887bb06a8f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651755, "uuid": "9cd06938-25a1-440c-a136-06e220a57d0a", "value": "12288:QRLtg/MA4cScHfc4eufW/AGVudhVJzLGKb4ZVU:M6EkfDxqChVF6DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651755, "uuid": "03ea1db0-4f05-4368-bb91-5842590f6052", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651755, "uuid": "04266ac4-0b3b-4d6d-9218-af9b269bfea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651755, "uuid": "6db58267-2c02-47b1-ae61-d251ce2296cf", "value": "succ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c34f5e-cd02-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623669767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669767, "uuid": "8f17c7ed-1b8d-4729-b91a-3f1bc6b2b200", "comment": "Malware payload (AgentTesla)", "value": "c3d31dc9fb740cefd03e4ac3ff08b797", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669767, "uuid": "d8c707e4-ae5c-44ee-9e92-9aa14cd9feeb", "comment": "Malware payload (AgentTesla)", "value": "d035fdd716b84658379f5d36275c2e764a690c7f4000feb4ce4c0c3c76e7bae7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669767, "uuid": "85ce1dcd-7581-417e-b1e9-8f80963dc558", "comment": "Malware payload (AgentTesla)", "value": "a38f2f1682f070283c46f1208dbdb155d4f0b5de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669767, "uuid": "d8b44c38-474a-48e9-9261-787f81484ecf", "comment": "Malware payload (AgentTesla)", "value": "315ce1799c402e70fadc33c951173a2b53f239742e0d6d8b6bdaba166859abe7e57efc7e11156a7338899d786614fc9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669767, "uuid": "f6656b20-a7f8-4ca0-a14d-f970155f8ef8", "value": "2F657D91F150C89AE86F49B1AC37957010F2BE8D55A4910D29D9BB2F7AF334160AFF0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669767, "uuid": "bf8c6c8f-1099-4666-8f9c-d392fcc0a772", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669767, "uuid": "d448f1ed-8073-4154-9aa7-376a30e8d98e", "value": "12288:ctHNa5LIs6nMtLq0iBTrtT5V7u0byFhtNm62q473hMG/wkYnUMkPsmN9VCZ6vP:ctHNQdgM9qPlrtT92FjA3yswfUMkPLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623669767, "uuid": "8658a51e-3f30-4bd9-b5f0-060c42aeb573", "value": 1425920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623669767, "uuid": "47f4211b-8d31-4b38-96af-445e165a6e49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669767, "uuid": "b835c99c-68df-43b5-80d4-4afbef0d4871", "value": "Dv3nvr3mMaDxvbv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb8c932-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647332, "uuid": "fbff805d-9775-4afa-97c9-754dc22031d8", "comment": "Malware payload (AgentTesla)", "value": "5eaefa86e78c38e75efaa60365e81827", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647332, "uuid": "ad119337-2e87-4e2e-915e-47a309231934", "comment": "Malware payload (AgentTesla)", "value": "d40555c64312025571d9eb3eb64c0d3267f9672f4e8794e378db09d72a192e9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647332, "uuid": "f7db5f08-ce3e-4920-8eef-37ec9630f036", "comment": "Malware payload (AgentTesla)", "value": "256bd54fe70c0ba57def93d96539cab8cc9ba096", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647332, "uuid": "d7eb824a-9e91-4ca1-bf07-7892c3d73a53", "comment": "Malware payload (AgentTesla)", "value": "be4a26180d68861e20c1c4086041787ae519e043f97156f48f3ea7071e23431a36cd015f872298d6089afc2714f9e436", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647332, "uuid": "ec4d3d07-e6b4-403e-b814-0a0f62cb9265", "value": "A005F1AC721075EEC86BD1B5CAB41C24EA643C7B972B5207901375ADAD3EA83CF544F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647332, "uuid": "8be55ff6-006c-45fb-9bae-f051165fdfa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647332, "uuid": "8efa0bea-9341-4f08-8134-b5df5936cae2", "value": "12288:2ZM4e/ZUdtbmPt2nxJ186BiO+2zht9K7gzFhp9bdyDuAl96Wcf1SEjLgxrhj4Lpg:2NeBUdtSPE8qiOJhzFhpFE9l9fDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647332, "uuid": "23ec9de8-a12e-4d91-86b1-8c3cd00b160f", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647332, "uuid": "f47d5aa8-1205-4be3-a5ec-d35d272384f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647332, "uuid": "194bd8eb-917f-4173-bad9-04685402ce17", "value": "PO_061421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd3ce2b-cd03-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623669856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669856, "uuid": "6535154e-acb3-4135-8630-51c387fa6595", "comment": "Malware payload (AgentTesla)", "value": "c7460702ea382e96fb9fd1c78b3845ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669856, "uuid": "d46e5b8a-0a7b-4cfb-a45f-f21495fb2fdd", "comment": "Malware payload (AgentTesla)", "value": "d5917dcf259b918abe37b72bc45551cdb5d4c33da80c2c517f15097c71554c74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669856, "uuid": "d864e00f-909d-4094-8f0c-963acaef575f", "comment": "Malware payload (AgentTesla)", "value": "139ff70d1126d2c958023e86b29b43600302506f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669856, "uuid": "3786b8fc-79fe-4556-9b68-6664ce355329", "comment": "Malware payload (AgentTesla)", "value": "25e22fb516db0809d833f2adf0af8041ad25d9ef7e1ccb253cefc170278f0f44641b60772f0a4414854fe95611d713ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669856, "uuid": "e92fd388-1663-441c-a6f4-eccb97dc1098", "value": "F615233DF9EE0A5BE7A3FD368E01DB101995DC2A638B941B830278C970F137A79D1946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669856, "uuid": "1518a886-24fe-4667-a64c-ec180370d929", "value": "24576:tXutu+DUu0ALt9K+hs3WsE9+wFP0ipJ6vB40sx4zu4oU5:t+tjDfbK+hSWsEvFOWPx4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623669856, "uuid": "226e4834-0a15-4f93-ad59-c2c1705da252", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623669856, "uuid": "4386e6d7-2dbd-477b-bf18-3b3d34c01983", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669856, "uuid": "00c5143b-5d55-4123-bd12-415083db887e", "value": "SX-L21182 \u9ece\u5df4\u5ae9EST new order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32b3b50-cccd-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623647021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647021, "uuid": "cd12d19d-5d13-4040-b098-1c9ae8b77559", "comment": "Malware payload (Formbook)", "value": "d063c38996ad3cf5c04b073976afec23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647021, "uuid": "707d1234-aa15-4d3e-b037-227731b34253", "comment": "Malware payload (Formbook)", "value": "d654d8728cd5b7c24ac8b82f7fbc6e7429b46fdb57bb384534242ca4e5a5043a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647021, "uuid": "0d6e6834-f410-48dd-85ca-2c46cbb4359d", "comment": "Malware payload (Formbook)", "value": "ccbc5e28ea89a5586edaef635de2f5bde3047ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647021, "uuid": "a1e7c945-b281-4c82-b103-56e5356ec3d1", "comment": "Malware payload (Formbook)", "value": "822a204197f82eef5037260b27fb13381090d4e62e0792151aa777768c3d2cc1ff273a3580dd395b58f8dd41e1115a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647021, "uuid": "304007ee-f5ac-4c05-8dbc-159c549155bb", "value": "7F24124E25DD84B3E0A7953502B2CF6BEBFE6756270693435F181F6E7A240D21C026DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647021, "uuid": "c037b07c-0cd7-4916-a17e-dbcddf444e1b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647021, "uuid": "8886c79d-3517-4de2-8fbf-6e8e7344b33c", "value": "3072:DQIURTXJ+Mg2P0dNeCTwg6F6w4ZqerWvHJW4nVzkPTk1Zsh5GXl+c6PW/umUMsXp:Ds9B0xwKw4ZPrMLVgAgOsZxMr9QTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647021, "uuid": "5d5284ae-d043-4846-9e15-a036dd1a0455", "value": 227516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647021, "uuid": "43e35058-2b0d-4705-b9ee-d0c5712ae352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647021, "uuid": "cf769898-ac1c-417b-80f1-59a105df1b7f", "value": "PISALES-CONTRACT_BANK.SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48394e48-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623654492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654492, "uuid": "0dee9bbb-a6c1-459a-a8ec-26ff5d89e139", "comment": "Malware payload (RedLineStealer)", "value": "6d53c953b1e89a917d1597cc8a516762", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654492, "uuid": "e6660a0b-e298-4b71-9957-ea9b7d3d8b3b", "comment": "Malware payload (RedLineStealer)", "value": "d6790cc196be01cc853b498b7689f588d1679b19869fdbdb10d4c47dfcd55ad0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654492, "uuid": "ded196a9-25b8-46fa-91d6-895527754cac", "comment": "Malware payload (RedLineStealer)", "value": "24d273757d1dee6f0c6736e16c28c80159dbbe80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654492, "uuid": "666e13a5-20bd-477f-8279-2b506bb80c29", "comment": "Malware payload (RedLineStealer)", "value": "1969eb1afa8f03ca559ac9270015c38514d426873c101a00d2bfb6d036e6f7e6d66b1a81ca0c614806d0f5e64be1e9fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654492, "uuid": "14573008-225c-4ef2-bed2-f7a17579e00c", "value": "1D15FE1829BFD019D0A3FFA12EDCA4FACE9A55A3650E753B109053274F22B80DE4B57D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654492, "uuid": "1a3740f3-3b61-48e8-9b11-55704d051091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654492, "uuid": "c94f65dc-c446-49f6-be81-da0d5e648e0c", "value": "24576:UERwYEkEkEkEguI/v8DVZwiCFMc5icEFmI5n05CuEjGMRI:UE68rLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654492, "uuid": "b3b58df0-91d4-46f4-8a0c-1514bb452b18", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654492, "uuid": "de1b9d3e-2452-4956-ba4c-9c1798400a2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654492, "uuid": "fe925dd0-e5a0-442d-8a20-a1a20a6a457c", "value": "6d53c953b1e89a917d1597cc8a516762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5464cf0d-ccd0-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623648070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648070, "uuid": "55504fed-5889-4069-afe7-fde59c4786bb", "comment": "Malware payload (CryptBot)", "value": "a79efb7eb5d915c8b837aca5421b432c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648070, "uuid": "a9f02662-2a99-44af-bee5-ed46be86facc", "comment": "Malware payload (CryptBot)", "value": "d6ccee757bd852a89ed20b524396d253e100e23620e5250273901da18e29bba8", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648070, "uuid": "1ec353bd-032e-4dd6-a824-583465016ee3", "comment": "Malware payload (CryptBot)", "value": "432a4c5f95d08d82816b9b7e5b2daec2a2b143d6", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623648070, "uuid": "9256ecb6-b36d-41bf-b9eb-a15ecda62830", "comment": "Malware payload (CryptBot)", "value": "c6b97ea95d394ebf46629b37975feb8464c8d16aef7076daa60487e4f47331f82b290b668a9089954a71be07240f5d94", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648070, "uuid": "81580824-2129-4a6a-a9fb-e3408049edac", "value": "DD851233B9D98E3AC0651A3154B0EE36D1B4BE3205148607BACC8D6F79FF684E64632D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648070, "uuid": "db3c85e0-6451-47d0-ac3c-99b803f90a47", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648070, "uuid": "3b8f1f53-dce7-4334-87cb-b486e1d22ee7", "value": "24576:mCW07TsuHV8NAzW+5/vRb7n2zJaqVoG1AzFaNVNorNHAcWTLiCGigaeHWnY6CF:mTysuVFt5b7uvVoG1ZqZgcWJgaQ//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623648070, "uuid": "d32fcec8-3619-41a7-87f9-2a13558cd84e", "value": 1813263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623648070, "uuid": "ec776442-70ec-42f7-ae2d-4259bf87f607", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623648070, "uuid": "ba6ed781-b0bb-446d-a91c-7b3190b256fb", "value": "a79efb7eb5d915c8b837aca5421b432c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af818cfc-cd06-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623671416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671416, "uuid": "9b557251-d865-4585-b240-ce211aafab27", "comment": "Malware payload (GuLoader)", "value": "22dc7d78d57602045a896d57111f16f6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671416, "uuid": "74817c6e-00f9-4151-a1b8-aa35511d6c27", "comment": "Malware payload (GuLoader)", "value": "d6f21eb6314a2add1cd5c4cc1c9849f663275e5c60797e051bd9ddefcebb7799", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671416, "uuid": "f9fe7812-ff25-4f8d-a428-8d15f55bece6", "comment": "Malware payload (GuLoader)", "value": "a05d8c787ab670937adfa55a430fb059fe61a487", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671416, "uuid": "053b5d23-b75e-44ac-9f49-110554b071f9", "comment": "Malware payload (GuLoader)", "value": "372928997cb10c47ba53422e0da25db4b53a2953df5e416433bfd3e1c79cb64706a8a8780419e3c2f20b9a60e0665bdc", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671416, "uuid": "ce6f1d7f-5640-4ca5-ac44-d5ff8b84a841", "value": "6C55330DAC986B5AEB0F8F33C587CB2865EFDF15425AA09B1BC67524367433D9B0D608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671416, "uuid": "312e9f8a-0874-4d0c-bb54-70f93b57637d", "value": "24576:66lL69gyCuhqO/29pRca4ZJHzJv6hLtDU0LNkVG:66lL69gyCUqM2nWNZ9v6hBUyuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671416, "uuid": "77de85e9-ad71-4d7a-bb24-2e082c0a1a2b", "value": 1324544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671416, "uuid": "db254601-1e78-4bc4-9217-1200aa1cc5e3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671416, "uuid": "37d6212d-4892-447f-b1b5-de93517b8d65", "value": "DEBIT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35347110-cd22-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623683237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683237, "uuid": "12631053-76e4-47cb-99f2-5921a4fc7296", "comment": "Malware payload (AgentTesla)", "value": "4acc1921f515b4703ac35c23fd0fcf4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683237, "uuid": "fdc9d70f-542a-4a68-8a10-4e566f765d8e", "comment": "Malware payload (AgentTesla)", "value": "d8898abdff69091eec6ceb105dde20d1787f47e9835645a3e5ea256f86d07d32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683237, "uuid": "e6e4715a-0b89-408a-bf42-2b4981729f82", "comment": "Malware payload (AgentTesla)", "value": "101bc1e70ed7c92235b53788bf8f01c060fc4f40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683237, "uuid": "4a608ec3-441b-477e-ae86-52a30bce000c", "comment": "Malware payload (AgentTesla)", "value": "924ce40509dfb2696dd39eabca7bd92349d1333e6e5b2c038408c3e3bdc00bfc44858952011fc0c4ee2af3279a32c2d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683237, "uuid": "c4bc467a-de37-46eb-aa25-7e123e97dca1", "value": "4E15BF134ECF826AD2744DB65B31AC8781325CAA2948B3223EC075BDD93B6EDD8DF511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683237, "uuid": "3545cdb9-01c1-45ae-9259-cfdc623d89ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683237, "uuid": "0e016171-c6b6-4902-a1dc-7a0699a7f3ff", "value": "12288:od3SMPQipP5pfwYFptFfJbxkOgAzrg18F0WDgInR6RC3n42Sd0Rk42:KqipbfwY7tFRbxkdAzi8iWDgpRCnpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623683237, "uuid": "e9de4dd4-ec21-4673-b8b1-48e7d1cc9a1d", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623683237, "uuid": "b82bdbcd-22a4-4019-bb08-c49430e44616", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683237, "uuid": "d792124f-eed1-4ca8-a340-29fe53b3a5c6", "value": "TEC GLOBAL PAYMANT.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb63bbcb-ccd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623651357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651357, "uuid": "4064849d-e1c0-4b13-8ab4-41d8dfb56320", "comment": "Malware payload (Loki)", "value": "139a636266f935852aaf42e24e32bc94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651357, "uuid": "d8e57316-6974-4d81-8c22-c3e58009c52b", "comment": "Malware payload (Loki)", "value": "d8daceabd71dd935eac99253f202875dad8bfc325a83df7e67277df6e2ea90f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651357, "uuid": "68d28ecf-9759-40f2-b997-1f42cf8b6f3f", "comment": "Malware payload (Loki)", "value": "0ddb550c96e54deb9f0987d826a9c2c576cb6abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651357, "uuid": "81e1b8d4-e820-441d-8515-55a2e1ffd946", "comment": "Malware payload (Loki)", "value": "9eb4d77b610f24af055823fbf43b189962683018974d30ec831c71b36992c1e38d2892140c4c540fcfc00dbbf8cd08ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651357, "uuid": "b86a1003-9969-4b1b-9e36-192b58fbf614", "value": "A5A32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651357, "uuid": "b40f6d03-291f-4c34-9c48-54795f09f261", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651357, "uuid": "df07c970-b853-46d4-8a74-ddbaac30dbfb", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651357, "uuid": "b0900be5-24da-4220-8401-e79b945a5adf", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651357, "uuid": "a3c8ec92-bcae-48db-9056-5127060c5297", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651357, "uuid": "a8ba442e-d181-4bfb-9f65-1d9b197f6237", "value": "ob.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a049128c-cd05-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623670961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670961, "uuid": "3a33ec88-a3ab-4994-9d5e-361461ed2d4c", "comment": "Malware payload", "value": "3b35eab950d40d9ddb359c65d1b22a16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670961, "uuid": "f8570040-e2e9-49a9-9fe9-dbaa26c79220", "comment": "Malware payload", "value": "d92a15b3a5e7cb7e546ae372713f3ff168eb3095beba1ac84b1c39c7859f3dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670961, "uuid": "a3a91811-57a6-41ef-be88-ef4ef90c1b51", "comment": "Malware payload", "value": "a68c8b46ee8fcabb3a23ae41d573c80a074ff4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670961, "uuid": "b6b8fcda-beaa-402e-bf0f-818007d5313b", "comment": "Malware payload", "value": "b5ef6653530eac4b5cc552cfc481ed57a0367a8ce0a82575af8a48bd97d8cbe6f8dcf18e1ebd38801946697d47f797de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670961, "uuid": "ec02dcca-247c-4e14-8218-d01f939d8b2b", "value": "9123E08B4D7655E7D8A00E70B0CEF864AEF1F5696DA078BF223147953CE07B02AD025E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670961, "uuid": "fb22a40b-b591-4183-b574-afd976710316", "value": "c1052dffb37e2dbb005b09f29d480f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670961, "uuid": "6a56325a-821b-455a-9a41-92fa8fd87b9f", "value": "768:p3tb+wcXZUf7xNtCweXSlpzR8RhIvNIh+Kp7miOSDTXINnoLxYYsQiXXrA:vawcX0e9RhIvNZdi1DUNno2XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623670961, "uuid": "344759b9-2f60-48e4-b279-3011b3744688", "value": 47800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623670961, "uuid": "5661e626-22d4-4193-9d46-4681368153ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670961, "uuid": "9cac9da6-de1c-4fb2-b813-dffbbb508dce", "value": "d92a15b3a5e7cb7e546ae372713f3ff168eb3095beba1ac84b1c39c7859f3dd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39adcb5c-cd25-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623684533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684533, "uuid": "e2bea08a-4136-416d-8bc5-a0ee062c0f01", "comment": "Malware payload (AgentTesla)", "value": "452bdd3ecef79d3b896901b242f61a15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684533, "uuid": "3c83518b-05e0-493e-ba39-de6335e1da34", "comment": "Malware payload (AgentTesla)", "value": "d9514b79def65a05aa2637d0afff60fea9611f6464f24d372d7cce3bba0ef240", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684533, "uuid": "d1a48ed0-ba7b-4b15-9400-86fd284aaa0a", "comment": "Malware payload (AgentTesla)", "value": "e8fd2f5de47fe780fc5a3f3c65060c1ead082907", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623684533, "uuid": "d97b3381-a2ca-49ca-baef-46c66d5eb884", "comment": "Malware payload (AgentTesla)", "value": "b1f4136e8e6b369dc5c95be9a17c945177665c8f268cff6e210b3bdc5cc53b46de1381ad3938a8264742572943736ff0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684533, "uuid": "76010251-3c75-4bd5-9469-6230f46872b1", "value": "6015CF2123542FAAF57DA3399024050097F5E51BE326DACEBDE651CE0976F82C7A2B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684533, "uuid": "781f6a49-b47d-4112-a637-3b8a0a18cfc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684533, "uuid": "c8228cd1-762b-4e93-9b81-d536f042e143", "value": "24576:vbuSJBuS80rNeBUdtw8e0L8Bf2DvHiIhpxGAzyDUz6s:vbuSJ4S8mwBUw8LL8Bf2DZhpMAOY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623684533, "uuid": "1719af77-f384-4feb-bc4d-532fbf236fa8", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623684533, "uuid": "be817808-248a-4309-9a04-743e4c113621", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623684533, "uuid": "1987725a-1974-4831-a44b-2bd8926601c7", "value": "Swift TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21da2f1a-cca5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629517, "uuid": "809c42ca-96ca-45d5-82f5-a9734f5f1e15", "comment": "Malware payload (Gelsemium)", "value": "77bb729852a957efc606c64180543ea9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629517, "uuid": "9c1f1d1f-417d-413b-a06b-41a570597675", "comment": "Malware payload (Gelsemium)", "value": "d986207bc108e55f4b110ae208656b415d2c5fcc8f99f98b4b3985e82b9d5e5b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629517, "uuid": "4566eceb-808a-4fd4-a08b-f70ad4a287e8", "comment": "Malware payload (Gelsemium)", "value": "eca6363825c079099f3729097c06808ac32d4547", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629517, "uuid": "eb6caf7f-5ec7-4c80-ab15-c5e85f52eb8e", "comment": "Malware payload (Gelsemium)", "value": "51d2113c45ea954ac8ade608763fe61c8005d7879501b154f72eeadfaae14424758a1965cc4a4844af9ba0ea26533932", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629517, "uuid": "a94dab52-0db0-4919-813d-63258f36ba0a", "value": "42B3B368BB144391F0A38A79EDF28656C27374043F1D5B8F8654A21BBF3B5A4FD22253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629517, "uuid": "354ab9e2-cc80-4ad6-bbe6-893b6103aeed", "value": "ab8d0c44c47c62bd5becf6a9c9783505", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629517, "uuid": "7c6ff38f-6420-4bad-b874-9ecac2a87f96", "value": "1536:kvIOyk6Y8rTSsEB8jG9vxsu0nNw1DGIuilQ58IAeJ2:kvIOoz+YaDsu0nCPpQzAeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629517, "uuid": "0329bcd6-ce39-4906-ae93-ed7b587f96e0", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629517, "uuid": "656dead2-ca9f-4634-a179-3a63bbdd998c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629517, "uuid": "03551e95-e7c1-4ec5-b664-9069e02981d1", "value": "d986207bc108e55f4b110ae208656b415d2c5fcc8f99f98b4b3985e82b9d5e5b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6530bb0-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623652583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652583, "uuid": "c24f7cf0-e9a8-4b33-af0a-bfc195010239", "comment": "Malware payload (Formbook)", "value": "7a4ebd1cef6f3e6f6e8d333eed88f9a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652583, "uuid": "a01c9d31-3473-4ced-b84e-0f03c71c7222", "comment": "Malware payload (Formbook)", "value": "d9a4ec725c94cafab9a184ac87c556d6f728256c56f72d9b410b46618d2a0dbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652583, "uuid": "d78677af-7ecb-4a71-9847-ae5e9a852a24", "comment": "Malware payload (Formbook)", "value": "25d19b92642d009cf15c2f605626edbecd2f1e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652583, "uuid": "093234b5-cfba-4ff5-8b86-22b074732043", "comment": "Malware payload (Formbook)", "value": "f1f017837dd753f4dc09dfd42256337d9ed69f88a5f5d97b5781fc9f90ac85be4482dde3170b07604640287e8bf33757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652583, "uuid": "978817dd-ccc5-4344-94c6-a3ccec354167", "value": "B7241209B3C045D7EA99067280727B7BF3BAC34133116B5397B90D9B3A36207DD4B29A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652583, "uuid": "6b5a5e27-762c-47a5-ae39-778da149d2eb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652583, "uuid": "743f9c39-1962-4c2e-8eef-fb64798e7d0c", "value": "6144:8Qq+mDKFO7/w+HmUgLExDWV6s1N8H4Xu2jJc6p:TmDKFUrHmNLIs1N6Gu2jJPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652583, "uuid": "f2cee171-7f11-4be0-9842-08e6e43bbb24", "value": 218157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652583, "uuid": "80ed80a8-5fb9-4e51-a43d-0ef1d49efd37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652583, "uuid": "e606d65f-5f92-4b08-8fe6-3a1d8fcc235f", "value": "AWB 6299764041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dee795-ccf7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623664776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664776, "uuid": "5f137a68-a594-488e-a077-31ea52e6a1b6", "comment": "Malware payload (Formbook)", "value": "d102c1bb2ad097e6b90e1025734bb971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664776, "uuid": "f131460c-dae0-47a4-b727-f4cfbf1cec90", "comment": "Malware payload (Formbook)", "value": "da9e3cdd0874cc1e8fcd3ed354cfb48d39f0b2ec7b0b4334ea85d7da7aa32f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664776, "uuid": "1241a22d-8c4c-4a62-9bfb-7bc91f8b030a", "comment": "Malware payload (Formbook)", "value": "801e9d350cf27a5b6d0b82d09989867834842005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623664776, "uuid": "9d6af0b1-d7d6-4a22-a743-d71a75ed458f", "comment": "Malware payload (Formbook)", "value": "05c35423fe9e82a9e75e208d465c1b138c7de34252cb8c5348a3b6754a16ef2447fc3685e3afffcd651f047189fd432b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664776, "uuid": "b10fdbf9-e92d-45cd-a793-9177c0eef594", "value": "3B74D0D7B2C1B1F7F3D959F139C5E168E56EEEA4AE8310136E88398C20F782E2145953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664776, "uuid": "9b842ef7-d39a-4cd1-bc35-29db9c1d9ea5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664776, "uuid": "738b98c5-b7d3-4481-af32-b4911f6fc9e2", "value": "3072:BQIURTXJUqzSLpzDmOuOVOoOROSg5U40O49PO2gWw9BMmHbzMyyM/wFY3cp7oG31:BsCV1ukWmXlH/wFY3cOsoNXApd8pejJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623664776, "uuid": "2f6a0dee-0de4-431e-8103-cff357b19648", "value": 344587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623664776, "uuid": "ae8d934d-9010-41e9-84ed-a4b566fd4e3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623664776, "uuid": "02b2bc34-c6c1-4d5a-9844-12569ee3671e", "value": "swift_copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae97095-cd61-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623710627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710627, "uuid": "33669a9f-c733-4979-9482-2e462f9eade2", "comment": "Malware payload (RedLineStealer)", "value": "ab6eb46bee94ffe3e7b5a5b3fa0ac1c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710627, "uuid": "90963bdf-c89f-4b7b-9b93-23d7d4f205d9", "comment": "Malware payload (RedLineStealer)", "value": "dab0f355a74470e01e1aecc9390a17cd0ca5deb098b3f5f1eb34d313d7c44562", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710627, "uuid": "2c58ace7-1d58-42ef-ba17-e94cf25af093", "comment": "Malware payload (RedLineStealer)", "value": "9a3121df630d8a801c093a34cc3fdef57ef05620", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623710627, "uuid": "f1ad79ee-7e4a-4e0b-bc56-8f9c9d413326", "comment": "Malware payload (RedLineStealer)", "value": "fa4530ad9e23920aca4ce51f781fb0b1601c489a132a1f45cfae7c85d04eb6cc8aaac4963244325af4f656f015a41cbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710627, "uuid": "f02aae50-7d10-4202-8b82-3c60277c3b0d", "value": "9F459A7137A882E1C4E75530C19EB7264A542CF2D6E6C2B3FA953F6A0B50393DF613A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710627, "uuid": "ba5df869-2115-4aa6-8cca-2c11454fd98e", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710627, "uuid": "191d9369-3ecd-4a91-a3a8-ccfdb7f221c1", "value": "24576:Ak70Trcfif8FnVvvjKlEs/cCwmgkhfnR9NIx0s3J1fjyAZ+s:AkQTAfiqZb4/gRkhfRybyAZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623710627, "uuid": "eb109421-6dae-404a-a21a-ee7c3393b0a6", "value": 1264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623710627, "uuid": "b0734846-35b0-403b-9614-319505f26d01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623710627, "uuid": "feb65a6e-4eb8-41ca-a73a-05a5a8cf3b64", "value": "ab6eb46bee94ffe3e7b5a5b3fa0ac1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6bf97f-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647255, "uuid": "52515dcc-9230-4df0-a30c-5be151dd6bf0", "comment": "Malware payload (AgentTesla)", "value": "172f2be1941c30d84659d5b59b1ca1d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647255, "uuid": "4a76ecd6-450f-4d0a-b882-b3fbb081fc5d", "comment": "Malware payload (AgentTesla)", "value": "db6687a169043b5fb58322561f70b80cde74e59cca41716327447a2ad11d37ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647255, "uuid": "1fc08dcd-509c-4001-95e7-d4a65dd03c39", "comment": "Malware payload (AgentTesla)", "value": "bb87052e1d5b5c6896d5c774a298918f94384d68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647255, "uuid": "a184428b-466f-4b24-88dc-cc98bb0bf7ad", "comment": "Malware payload (AgentTesla)", "value": "bdd29cacbdf18bb5bf5b9b1690a1c7edee9ea45c3ce8032c281b20778944e024bb7f7a5147b4ed09b3d34613a5e07fb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647255, "uuid": "49bae2f1-f2cb-4b54-8e7d-2b7035dba664", "value": "4FD4F1123AFC4766F27A8BFC7C921555877AB467651AFAAD089111CF1E22B01DC80B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647255, "uuid": "4872d8d7-fda3-45e4-a593-3b03d03beaee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647255, "uuid": "8b5826a9-dd51-43e0-ad28-c06db9a21551", "value": "12288:aq+4bDu/IMGN98YGsUDHV1evSGVFnyCB6JvQQY3+:aXUu/I9+VjV1eXFlB6J1Y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647255, "uuid": "5e96b92b-b25b-4bdb-976b-3daf34ec2441", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647255, "uuid": "433b9e70-6a0f-4870-a8cb-5574962f1f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647255, "uuid": "c3805ed8-2fd4-4312-ba66-d2115b9e66f2", "value": "RFQ- PO #89230.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89370714-cd12-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623676506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676506, "uuid": "2f030026-d3de-41af-9063-19d1b729e233", "comment": "Malware payload (AgentTesla)", "value": "1e62ef2756b05e8a6824cc21c9bc9dd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676506, "uuid": "47c31160-aaeb-44b6-bddf-49aef59d5f17", "comment": "Malware payload (AgentTesla)", "value": "dbb86026ffeef97385daa7d9eecec9485611e33383fbdf90a5b91f8841ffa6e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676506, "uuid": "2c02d414-a892-44d1-ab51-6ac31e95bea6", "comment": "Malware payload (AgentTesla)", "value": "19bc78f29583a8b2d7bb020656a7eb31c776b321", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623676506, "uuid": "9281e9cd-27bc-4cf7-8728-f5fac4adaf95", "comment": "Malware payload (AgentTesla)", "value": "e384d1ee86bfc162e43db91be1d6a233a590d4b9945e4eb4133bbbdb0e9bf902765ca4d42b650e9804a0db158bd6a034", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676506, "uuid": "15d1422c-57e7-4951-99d5-3ac88277773e", "value": "C405E02523889B91EA7E4734A165449093F1F82BD329EFDDBD9904DD0BA0F81C36375B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676506, "uuid": "72c5bfd5-2ea2-4808-9078-3cc778649aa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676506, "uuid": "d8477a24-a92f-4b23-9646-9cd9bf12a998", "value": "12288:yrjeYeaTLMuV3NXQhiXjgS7kmPO3/09c9a66n6TN09VCZ6v:pYfTLMuVNAa7kmPbJnk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623676506, "uuid": "539f8c90-482b-4384-a5f1-aa5ea0a1e550", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623676506, "uuid": "0e626205-caaf-466e-8490-7321ba0841cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623676506, "uuid": "531c1454-88c6-46fe-8cfd-98897a54cb4c", "value": "New Inquiry 20216013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583d681f-ccf5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623663968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663968, "uuid": "b4581ca9-33be-486c-ae0e-b00d3d580ef6", "comment": "Malware payload (Formbook)", "value": "6369c4aed8ff9f167224f4cbe04ed0c6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663968, "uuid": "33a62820-d658-4e3c-8e65-1b1fc5fee3fc", "comment": "Malware payload (Formbook)", "value": "dc6080f6871563778eb833958731b2dc1012dc3287d40ba4f09afe59e326d591", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663968, "uuid": "d66d9889-398d-4362-b5eb-c15ed215736c", "comment": "Malware payload (Formbook)", "value": "174ce1f34cf2b794d421089197d1f607e988dbc2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663968, "uuid": "e07560f6-02fd-407d-b908-5c4c7470ecb0", "comment": "Malware payload (Formbook)", "value": "3deaaea8dc2f726701d3d971551ed042492550b32960be8c0f30b109b099f07f215aab7c455c98b26e93c48fa27501e8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663968, "uuid": "d4b05e60-a208-4307-b59b-2afae0a87831", "value": "F3659A0DA0BB5A52D3CBD5F0B6AFB30C566DB84D21C804594825C5ED7CE4CE9C7A8CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663968, "uuid": "6c28356c-7082-4e9a-94f6-c37e3b6f3c04", "value": "1536:lqy0Tyg+fffffffffKRffNf6Eq+OkKiDtf6zrQykZr6Eq+OkKiDtfffOfPfff6zn:KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623663968, "uuid": "0abe3aa7-c353-42da-88fa-25e6b1f80bca", "value": 1458109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623663968, "uuid": "e39a5137-1d53-4c57-9bee-c251000e01eb", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663968, "uuid": "37875bc8-d8aa-4edc-b242-0ebcf16fa1f7", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.13632.32321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9a3087-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623652115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652115, "uuid": "43adabf2-665c-4e87-870b-02ab6ec8af03", "comment": "Malware payload", "value": "9a5ddbc9e7fb50af1e69d360b4e4f767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652115, "uuid": "7e06c918-e4ad-48e7-8bb1-580c8af814ea", "comment": "Malware payload", "value": "dc760a13ca7fb2f24558a7adc6ca7d4465379d2594301232246e68e66496de07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652115, "uuid": "58d3d140-11b5-4d51-9312-1a383fa0e699", "comment": "Malware payload", "value": "7ac8786be31c1d4f163cb79d76d5bfc83b5eee76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652115, "uuid": "3b539038-38cc-4f54-8657-7cee384854b3", "comment": "Malware payload", "value": "03a473cfaccb200117cdd5851f30f38f604642b939d0685a234940de311b67c94cf9733a986300167f74a382f3c110c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652115, "uuid": "45eb453b-b214-4655-bc27-6dd3ec7697fb", "value": "78357E1A72118877D5371AB98F0FA7E4682EBE103918ED4E27B5390E7D75390392E09F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652115, "uuid": "9f0811ea-4c76-418f-8655-494387641bf7", "value": "44e7313214ce4e94380708f576c657ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652115, "uuid": "6cb9bef5-230f-4889-a01d-e40430ebe95c", "value": "24576:qepGLM7Yebb5CEZPi0WPHcPbq/XQBmE9G:qephlX5iNPHcPvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652115, "uuid": "3eb8ea6a-fb12-445a-a1e2-f3018bfe800d", "value": 1087330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652115, "uuid": "b5e84b4e-a59f-4d40-8bd1-45ca757b2f6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652115, "uuid": "3d200020-f50a-4d05-9c0c-71c324f58f7b", "value": "Outstanding_Payments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f14573a-ccd5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623650236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650236, "uuid": "5f3a48a3-52cb-4070-98ee-a3b853118282", "comment": "Malware payload (Formbook)", "value": "08be71bb5e0f6226239063bb4616a563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650236, "uuid": "be08b511-357a-4f61-9308-c1390b55040c", "comment": "Malware payload (Formbook)", "value": "dd4114ea355d3f70e7683fb8491e2499347b6133bd9ef6d094a0cb6ad8aa4609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650236, "uuid": "65dc3b67-731e-41e2-962d-815f3547d847", "comment": "Malware payload (Formbook)", "value": "7d5734ee654c76616c7a2c6cafc804c7e73c8793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650236, "uuid": "71912c04-32d8-466b-8ff5-2f3d2192c880", "comment": "Malware payload (Formbook)", "value": "7fcfe3927bc7e95ae9b62278ce8fea5cb12398dada50e30c4bbc868b25e17422cb28387886f11ed19adfe8a184814d02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650236, "uuid": "f0a3c422-4448-40b1-8251-389e4e208105", "value": "EC2412AE22C3587FD0921A71A5B3F776D7BFE706029272472B840FF55D500E6AA06B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650236, "uuid": "e5427a5e-f5a2-42aa-8e03-a84be493bca3", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650236, "uuid": "a72bfe1a-5b04-434d-b433-0df8222905b3", "value": "3072:DQIURTXJ+Mi9XQnv81DqFmxpfYt/8+hzHzfpdcWuI7bfh7zWst3hpSzkLV3C2ylU:Ds9nQDe0pw2uH9jb7z33DSz21ynmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650236, "uuid": "f332156c-5442-4c86-aa3e-dcb7e2ae1169", "value": 224079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650236, "uuid": "9ac7f80b-15db-462d-a92c-cf1f576f97f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650236, "uuid": "8bab5c89-39c1-4657-b565-6d0d1706afc4", "value": "Reference No. # 3200025006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888c37ab-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647299, "uuid": "7df3ea85-4b16-4575-8b9a-a3bc6793aea8", "comment": "Malware payload (AgentTesla)", "value": "f11872e4e4042e3c6591ae860f5af545", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647299, "uuid": "4089a5f6-c400-4f0c-a89b-f3613fd8cf3c", "comment": "Malware payload (AgentTesla)", "value": "dd86052fcd2d7211d77f59b18651536936c2894007f2b3733e91650a2b83d798", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647299, "uuid": "20f226bc-fb2b-4f0c-8fdd-a926f47e4066", "comment": "Malware payload (AgentTesla)", "value": "f109b9bf55a597d86c7673bfcc2b4d3c823b499a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647299, "uuid": "19e1f9e5-7db9-4db4-9cd5-4715b1094bc3", "comment": "Malware payload (AgentTesla)", "value": "c280a067ae953761f95c428d7adf167442bcbee8417b0c57d1026ddf4178cdf4247627fc4ffb201b5b6bdb6ba8f9e471", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647299, "uuid": "2bc1f1ee-18a3-424a-85d5-6d03d2b0b893", "value": "37F4239FAB0CD80CA656AEC594703F08DC3F2626D9A7BEE099C1DF285057E9212D65B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647299, "uuid": "6ee5939a-46ee-4e38-9123-02a503410684", "value": "12288:XNSh0iRcfP7AnrD1q6xiOK2Zhtba76zFLN9bfyDy8lv6McV1SmrLZbPtxwNk4:Xs+fPiqOiyPLzFLNRWblvr9Qpxwu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647299, "uuid": "3f111e25-cf6e-44fd-8174-258a4cce15c3", "value": 760230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647299, "uuid": "5753a217-bca4-46e4-a85d-573cbde00a03", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647299, "uuid": "b003e98e-b826-44c6-aaea-87ddf1bd7059", "value": "PO_061421.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf3a465-ccb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623635330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635330, "uuid": "bc5b3b70-12d1-4f5a-b81d-14e113f96ab0", "comment": "Malware payload (Gafgyt)", "value": "c2e12800431ef05d3b8ce35145d3db3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635330, "uuid": "01dd3576-6dbb-4d40-8411-ca2332201448", "comment": "Malware payload (Gafgyt)", "value": "dd902eafc5b62339d4aaa96430e8212efa6a4553083c39cdcd40cada971ad080", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635330, "uuid": "edba6290-d8e3-42bb-bfa3-2674f3186137", "comment": "Malware payload (Gafgyt)", "value": "d8d35bef0a65d98f96030b5324d41d513d12257b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635330, "uuid": "accf071c-a514-4c75-b995-543dba24766d", "comment": "Malware payload (Gafgyt)", "value": "0f349bf3cf1a91e58e20c239af0a80958fa7e7819f143f2f2d1c49c7674a07ea103321a2e030b84e50f8e6438b4a1be7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635330, "uuid": "c8b1e65c-5e07-4e70-af01-d45c3e25b91f", "value": "AFC32A2737270E23C0C9507102E31331FAB9DB6938B953E7E9D16DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635330, "uuid": "9ffbe04b-8bbe-48ff-88df-7e2e7568ce69", "value": "1536:fMkczuFokkFkR0QcQxULBN954wtY5jhM3tJphakuusrvVEj9/skYEP/UDjSQrD/R:L1+LBNPQYHphakuumw9/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635330, "uuid": "adf1d15f-46f5-4292-9da5-22cf2fd9616f", "value": 126921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635330, "uuid": "38ca1bd4-29d9-4412-a50c-f417f59ac064", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635330, "uuid": "2b073265-d28c-47ca-a404-e1b9dd035e5b", "value": "c2e12800431ef05d3b8ce35145d3db3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9c836b-cce9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658853, "uuid": "8d586658-0b42-40cf-93b8-8a0793e827a9", "comment": "Malware payload", "value": "5412890e617ba50254959334e6ab72a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658853, "uuid": "e4bb80fe-dba3-444d-88a7-179be53328e3", "comment": "Malware payload", "value": "dd9521c2cff23e51edd57fd044dfaea21e5d79165f8190c7980cc4da75958bd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658853, "uuid": "590cdfff-6b01-4482-9700-25a3f5f1db08", "comment": "Malware payload", "value": "fbcd35dcd7b59d2851e340d46ad0d41094812b8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658853, "uuid": "2501f6ea-fa8e-4737-a614-0d7f0e6b91bb", "comment": "Malware payload", "value": "b244804a16ee26b21c93ccf5c42c87ee95e219ab2c54fbcda1592f553a651b405dfc36353dd527176a22f65966668b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658853, "uuid": "e5490aaa-bb4f-4134-ae09-19ef1d1ef748", "value": "8E050100A791C0F4F1F716F89A7A9F7CA5BD7AA0572450CF12D52AEA6B349E0AC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658853, "uuid": "fde79c98-c6f4-4984-9785-76b5560e2263", "value": "fc6cfaa92140f1c3355fe4a8c24ceb23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658853, "uuid": "400dc249-dc94-4ce0-9a2b-8813ad2db716", "value": "12288:0LysV9a16Z7wIUQlF1SFFkgECLQf+nV9KmXYTxXjvM7EyzprwR8iz:0Vva1fIz1SFSqq+V9/MTu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658853, "uuid": "c33b411e-4764-4df4-8fa4-a941ef31104a", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658853, "uuid": "04be6151-370d-497f-9153-447a0f05560f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658853, "uuid": "0d6d28a5-9485-43b9-8786-2a8a65c01cab", "value": "5412890e617ba50254959334e6ab72a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443ed0e3-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623658351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658351, "uuid": "f547da4f-2390-4e4b-b624-dfd6346698b3", "comment": "Malware payload (SnakeKeylogger)", "value": "b28e0d492b6cb17536467dc1e268f16f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658351, "uuid": "c34f52a9-42f6-436d-af9a-dd20cd785b4f", "comment": "Malware payload (SnakeKeylogger)", "value": "dda39c591898a0ba4531e89cd697021803df43cbe038570e2a5657f8a3400a02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658351, "uuid": "fc8240b2-f769-4b8c-b0ca-ebd3ac49ee61", "comment": "Malware payload (SnakeKeylogger)", "value": "08ec06bd8ff1e631821fbcfe2c746a51d2cef447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658351, "uuid": "968d04a1-a64b-4d61-9c62-ca34f2ef94a2", "comment": "Malware payload (SnakeKeylogger)", "value": "c896fb5877c90479eb462044c61cd00b300ded3ab33b14e32ae8491710cc3e037e4f548d5bd64e4a357dab36b3d4fe90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658351, "uuid": "7c38a1d8-05d2-4d1f-a420-e5a8f1fb28ab", "value": "1F8401143AE8802AD5735EBB6EE4B795D57EF5722602E34E2891134B8A13FC0CD91B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658351, "uuid": "9d58efd2-a23c-40f3-a523-736875e56bef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658351, "uuid": "073344d9-4e7a-408f-8733-9a3fa9ed4be2", "value": "6144:/u4XCcIfJcyMweb7yai7GMQcrMHQEy/5g75C6YA3cLIbqFqM24GvHjEP/kS7iU:m4XCcg5Qi79QcrMHQEc5glQLIgLGLa8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658351, "uuid": "c317ba88-921f-4781-bd94-d1f7a94fb090", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658351, "uuid": "46d90763-a887-4e4d-b861-1093586f8cbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658351, "uuid": "4e6c4f92-113e-492e-9c28-e3d1ca1eb9e9", "value": "Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3eda63-cced-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623660537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660537, "uuid": "24bbd3c8-165f-4b9b-8023-d4a9892da3e9", "comment": "Malware payload (AgentTesla)", "value": "8903ad468f550479c4af4df61c2b6608", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660537, "uuid": "d6a64c32-262a-4dcb-8fa7-122df00adee8", "comment": "Malware payload (AgentTesla)", "value": "de134ae66c48ed091150ca1a049becc01a88738cabeee214c4a4eef285cbbc8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660537, "uuid": "7539cf2f-798d-42b1-bf51-55e4d5c11267", "comment": "Malware payload (AgentTesla)", "value": "1315d278c7e2d7152d639b54fb810884fc3e6163", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623660537, "uuid": "7e684a83-d4e1-41c2-bb25-89c394e004eb", "comment": "Malware payload (AgentTesla)", "value": "c231d0cf81f82d6a37c1b7d5e138297a5ccece75cec1c4d9a87f7cd89322d7825ec39b70efb3fcaa113f8f9996b28e91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660537, "uuid": "4320aed5-b3dd-4fa4-9663-acc4cda1a764", "value": "D105E12623C88B52E6BE47349169019093F1BC1BD729EBCD7D9A50DD0BB0F81936379B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660537, "uuid": "040b4535-9bfb-4e7d-bde4-81abb20a2577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660537, "uuid": "b0481dc3-b3d2-4834-a2ee-6c83d8915e17", "value": "12288:TUenOaTLMPXTBNSd6x1KksmrxNoCNXJCQGA98KIBxiR9r89VCZ6v:ZnvTLMNvx1XNRNXkc8oRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623660537, "uuid": "e85c517c-ab20-441c-b6dc-40bc095660ac", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623660537, "uuid": "33ecf282-5369-4fbb-a9f1-73de6a9df864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623660537, "uuid": "29774ea4-bd17-4f17-9505-f5c842ea8639", "value": "SecuriteInfo.com.Variant.Bulz.466514.31789.5637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ede022e-cd03-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623669938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669938, "uuid": "153af8d1-a2a7-48a3-8f63-664afb89b2a3", "comment": "Malware payload (AgentTesla)", "value": "5be6ea87b100834245fb819af39ab807", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669938, "uuid": "e1a001e5-127d-4970-81c3-41d25066ea87", "comment": "Malware payload (AgentTesla)", "value": "de7e1613ab7bc3f5a2f3fe3e4922080e5477c4660d7c753a4e5f69bc16e78fde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669938, "uuid": "a04bdf8c-8eed-4b0f-81f6-df1a3a6c2746", "comment": "Malware payload (AgentTesla)", "value": "4fa0951848b0a0c535d21f2df28001b4b462456e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623669938, "uuid": "7b5b73ec-cdca-4f55-90cf-105c1cbce269", "comment": "Malware payload (AgentTesla)", "value": "41765ee43d69a36e195175782433038303abdd9026d4f183b975c1c3d4ab5abf6a9d9b8f60ce8b5ee52607b33ba0dfd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669938, "uuid": "8b51aa13-6a34-498b-a5f3-260370b28909", "value": "C105E12523888B55E57E4734D264418093F1F92BD329EBCDBDDA14CC0FA1F818766BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669938, "uuid": "3880ec1f-fc32-42d4-b4fb-60cac5745b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669938, "uuid": "9859a49d-9f78-4b85-8ba5-c3dbb9ed9ca0", "value": "12288:IFewbaTLMPt3DvqSBYxK5hBWed/udUxQwNQshmN2+v8JsdjePEYmSy9VCZ6v:twOTLMwSB9hwC5NglkJKjeiSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623669938, "uuid": "609f349f-b7df-47b7-98bb-4f66b4dd8248", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623669938, "uuid": "a64a607a-0feb-4619-a283-ae2b60885eb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623669938, "uuid": "24bd2f16-4435-48a7-a2ff-1bdf5f32f422", "value": "lista di spesa&fattura_pdf________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19851c4-ccfc-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623667232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667232, "uuid": "295f012a-8133-4845-9a18-8cc28dae7d29", "comment": "Malware payload (Formbook)", "value": "cbf03e1a562baede9d94c215a74ac817", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667232, "uuid": "fbb4c774-e516-4767-b44f-02f0544a8d5a", "comment": "Malware payload (Formbook)", "value": "df61529ef0eb5ae7fb3510ec72f36e820fe4b2eebbaae0379bc103074d2cdfb1", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667232, "uuid": "f7fc8dce-f78e-40a7-9b8c-1cfe891494d0", "comment": "Malware payload (Formbook)", "value": "fd16f41055991ad35e7b3e67fafe0cd5ae12f092", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667232, "uuid": "4e68c008-26a9-4577-82a4-8171ed761da7", "comment": "Malware payload (Formbook)", "value": "2e0b5bc58759cbc700fe5e8e8423bca089a800a027839ef63c5859d8b9db95713a04e407e0acd042226496d24b5dee1a", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667232, "uuid": "9dd5b470-2702-41c1-bc2d-2bb3e4192ad5", "value": "2784D0D6B2C1B1E7F3A959F139C1E168956FAEA4AD9310137E8C398C23F742E2105B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667232, "uuid": "c1a71991-2080-4ceb-948a-a98fb9dd5a46", "value": "3072:7QIURTXJUqzSLpzDmOuOVOoOROSg5U40O49PO2gWw9BMmHbzMyyM/wFY3cp7oG3z:7sCV1ukWmXlH/wFY3cOsoNXApd8pej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667232, "uuid": "c10aadaf-c854-4a22-bcd9-4fd914c30860", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667232, "uuid": "4a791669-81a7-49f4-a291-c80c274ccbd2", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667232, "uuid": "917c827a-efbd-4fef-b8a6-05c57d2f9cac", "value": "RFQ_Template.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa84e35d-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623652080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652080, "uuid": "94f26f07-3333-4486-b49d-9e241f0568cb", "comment": "Malware payload (Gafgyt)", "value": "fe2a3a9883042f50a71f5ecdeec48aee", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652080, "uuid": "eb547b59-a2bb-4268-a4c0-2bed61fea332", "comment": "Malware payload (Gafgyt)", "value": "dfafedf32271ed14e4eacf907161d3be83bbf8f04dee5f7990b04f8e6ce9f64d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652080, "uuid": "fd44f3fd-5ccd-4c40-b9b1-19652d318c47", "comment": "Malware payload (Gafgyt)", "value": "d8a44daa7d167d9afc7023b788128044404c12ba", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652080, "uuid": "1a353e0e-1a53-444e-b0e2-614a3b009dbe", "comment": "Malware payload (Gafgyt)", "value": "d84abec61c0a3843e29c533d5063beba3126ce02171c582eda97a36acd3dc1a3133b317d1bc3efa0e1deb8bc3b097656", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652080, "uuid": "5323ec59-ba09-4971-a60f-2a23c1f39a99", "value": "A0B36C176692C5FAC08342B92BDBA1618823F67D0B36331773D4BDA43F158C96E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652080, "uuid": "e9f7edc3-b474-4b0a-9644-97743a475e05", "value": "3072:7t2nlia9qRBFZm4z1EYfcbJnphawf0Jv03CKPCNVOXinYuM8R:WsVm4z6Yg9phasQcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652080, "uuid": "3e434023-f336-4f23-b768-30cf3b2053df", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652080, "uuid": "2e470071-fc8f-4a3f-a73d-ad781451c0ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652080, "uuid": "a0a199d2-d87c-46ed-a9eb-d311339090af", "value": "fe2a3a9883042f50a71f5ecdeec48aee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c220778b-cd05-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623671018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671018, "uuid": "330b3a4f-e8ba-4a63-b600-11243ea844e8", "comment": "Malware payload (SnakeKeylogger)", "value": "8dd62e77d56cb2c9fbdb3718149d48c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671018, "uuid": "b1e8fa86-5781-47b8-8661-a45004b53104", "comment": "Malware payload (SnakeKeylogger)", "value": "e025e9a54fd6a4a2e4f7520e06e26eb4560f3b4a64bf1be6809583532f612af6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671018, "uuid": "52063e7e-8604-4ff1-9f96-24b493e47169", "comment": "Malware payload (SnakeKeylogger)", "value": "04f17588ef3fe40f6ba5ca50da132771dae99a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671018, "uuid": "48e03c54-9f0f-45dc-9948-3e4f4c760fc2", "comment": "Malware payload (SnakeKeylogger)", "value": "309d4db912a106913625730a609c7a759fec9187e790e3f100272e052973ceef9025b74a5ed393b148c0feb7e950d4d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671018, "uuid": "4d867874-3575-4584-b88f-fd53bfbe902b", "value": "2905E12613888B42E97E4738D265419093F2F92BD325EBDDBD9914DC0FB1F81836279B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671018, "uuid": "a95a9ef6-3ed1-4a14-aa8f-29fa34f9d3ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671018, "uuid": "55799849-e2ec-41ae-a2e1-8ff288c209fc", "value": "12288:HoeHcaTLMx/PqDOWaJIv6lUrTk/EGTA9aee3bsTJVn69VCZ6v:ZH5TLMx/yOWaJIv6C4XAa3YVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671018, "uuid": "e57a2610-7370-405b-9d07-8477bcc8b794", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671018, "uuid": "81b2f1c9-5f54-4e37-b967-36a6a9f37dbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671018, "uuid": "c41201d8-526f-433b-94d8-947e6ea3d7a0", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69261ad7-ccb3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623635650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635650, "uuid": "93ded0e1-a50d-481e-a977-3d6b1ed7465d", "comment": "Malware payload", "value": "977addaf9bbd81677cbffac65bd2d634", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635650, "uuid": "c799f913-cc05-40b9-ae8b-4b23618ccfd0", "comment": "Malware payload", "value": "e18a0d54f977e5fe30095430f23fb39acc5533cc988ca3c05ee070ff10a98290", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635650, "uuid": "8155c2be-a294-4f1a-a3fd-86c753c71993", "comment": "Malware payload", "value": "29049293f7bcd789079aa0efb1116da314e603b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623635650, "uuid": "c452c2d2-12ff-4428-9c0f-0d39edbc7815", "comment": "Malware payload", "value": "5a505264990336699fb6e81d11deaf6ee321828412f50b8c5564428095cd55c00be1d31eaa64095b9f7070fd3f471fc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635650, "uuid": "161842f3-567d-4fd8-af7b-e126d941d2e7", "value": "0BB33A97671C0B43C58B5AF52D7737F187ADFA7102E225C1A40EBF801B72A701626FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635650, "uuid": "03c0c863-ca4b-4563-9f7b-7249477a44f7", "value": "3072:tHXHE3nvQJE3NzONRAQz5hIaOkmq2QnI0PDG4gQNcR:t3MyE3NzOIQz5hIa32QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623635650, "uuid": "487b3d33-780d-4a49-b4ce-079c77836ddc", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623635650, "uuid": "f454845d-fcf0-4244-8145-c7597b89e3de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623635650, "uuid": "3206ff1c-26e8-4ca3-b1f7-8567c9163ddf", "value": "977addaf9bbd81677cbffac65bd2d634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e5e256-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623652364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652364, "uuid": "0672fb56-10c0-426d-8507-d4d07a581fb7", "comment": "Malware payload (Mirai)", "value": "28ed7073b0aa4251c8b5add30f1f4dd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652364, "uuid": "f4e6cfc8-9dc6-43a7-93b3-75a2d0227d34", "comment": "Malware payload (Mirai)", "value": "e1e155f00a6c793f7be2dfed4a31a387b5612c62ff70fb797927a0fa322e22ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652364, "uuid": "bbf21f84-ee54-48cb-891c-3780e5dd7ccd", "comment": "Malware payload (Mirai)", "value": "15903be3aefed6a16c80ec91957c7cde1f51471b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652364, "uuid": "da7c62f0-7661-420d-bef2-aef522674c24", "comment": "Malware payload (Mirai)", "value": "23c95aba32130e8b6a15f92c15b91c88dda9207d2d950ba49ad3abdb95a6d1c1222b12443728f80bbac053e53547a726", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652364, "uuid": "5418db91-1af7-4bbb-a017-25a9d332561a", "value": "A1D36D09F707C1F3C8430AB9219BEA9F9521BE3949264D4EF3583CB4B7368C5B125B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652364, "uuid": "1b50a26e-1dae-4843-87f7-faac58b21b36", "value": "3072:pJ1FG/706t+wJUoTsHTBU+jBpo2ZSdcRnmq0ich2yeaK0FU:pnAjthmpo2ZH9mq0ich2yeaK0FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652364, "uuid": "63e2047c-a6c9-490d-be76-7761cf234ce9", "value": 141728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652364, "uuid": "1696ea36-abae-44d3-8345-d606114ed526", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652364, "uuid": "54035fed-0186-4eeb-af95-718eeb37c91f", "value": "28ed7073b0aa4251c8b5add30f1f4dd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d39b98-ccf3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623663325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663325, "uuid": "39c4998d-a3ee-41f1-98e9-72604d9a1645", "comment": "Malware payload", "value": "2b766f06adf2c73fb6da681572d72a6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663325, "uuid": "418ebc35-e317-4a50-9a07-73256bdf57b0", "comment": "Malware payload", "value": "e2e80df13f72ce8833c2b41643da4a1f99eb5af25422a40d1250a8a40cc92c2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663325, "uuid": "e4aa55e0-03db-4683-903a-c5402d2b9a3a", "comment": "Malware payload", "value": "afb90efc716ffad7f9b21b3930907d08e7da400d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623663325, "uuid": "0328c909-c1ed-491d-86bf-c0c2202f3ef5", "comment": "Malware payload", "value": "eebd0e3ea179981fd08b96867401805ed3f8868fad3e1e999f0105fa019a9fcda8738ffa840684dcdb5a55308d33a5cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663325, "uuid": "52d8ef74-c11a-41e0-8f3e-66fcf38ad8bf", "value": "9F36232572178871DAD9333262A4C6358B2A6D04BEF9C7DF5A5AF7E51BB03C0B1160B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663325, "uuid": "982039a5-daa7-4304-80ff-02a9d15f44ac", "value": "9dd8c0ff4fc84287e5b766563240f983", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663325, "uuid": "323b97c2-d082-4abb-ae2c-6dc501fd497f", "value": "98304:y9wAo0zbKuJjtc95IamQEcgfrEXtutTacMm2jDltezaYPwJxv1pyGpc79m/yUGLK:ydo03KUmEcgfrItucjpoz5UxqGWmypLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623663325, "uuid": "887f84f7-820f-40c3-865d-fcec8a1c1987", "value": 5203456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623663325, "uuid": "15d71fa6-a1fd-48f4-8a1b-2868cee234df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623663325, "uuid": "5d9d220e-3236-472f-a2fd-5e08ed9ec879", "value": "2b766f06adf2c73fb6da681572d72a6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20d7c3e-cd08-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623672386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672386, "uuid": "fc15006f-d7bf-4dab-a119-aa5a7d595279", "comment": "Malware payload (AgentTesla)", "value": "a20363fe55ad8ba70395ee1f06e59ea3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672386, "uuid": "469d1c66-bede-452a-ae8a-6274786bc53a", "comment": "Malware payload (AgentTesla)", "value": "e32a7ca9358b5364722ae231cd70a71934f4d5424a76ff68434bedcf284cdf30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672386, "uuid": "c0eebe70-d101-4d55-8f72-92e15eaf3ec3", "comment": "Malware payload (AgentTesla)", "value": "db4842cc45ee2c5fccb6d65bfa95fb1ed685ed69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672386, "uuid": "8b847e8b-2b7a-4137-b10e-dcc2139eaa15", "comment": "Malware payload (AgentTesla)", "value": "8bbc6d2347f1b84a93b83356bb9b9c3eed4547a2ec0c8021b404052e72df80a65254fba074cd49f244affa4fb7a1fcb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672386, "uuid": "06deaa7a-bc28-4e30-a8ca-a8ae37c30e4c", "value": "2044225E7CD988F7C852B3B015F65FA2F1BF6E0452425C5B2B3A5F844C5E183882A0F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672386, "uuid": "d4bd5a3f-584b-47ca-bb38-1eb0444b966d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672386, "uuid": "46480f20-765f-4b48-8706-98098b9c339c", "value": "6144:ksZRnuPPn8SAJkbRgd5mEyxr+bLHNCbAwKZjYgAn:3qPEJkU5WUy5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623672386, "uuid": "970d2cc1-cd14-4a5c-a0c4-9a732c0d3674", "value": 254434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623672386, "uuid": "454b50de-d4e7-4320-ae3a-f26e726ef215", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672386, "uuid": "e2d20dfc-80c9-40a3-b772-4ffdc9485a51", "value": "RFQ FILE PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504e9d24-ccf0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623661807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623661807, "uuid": "f6708e7c-355c-4dc1-8f08-7f1710b8073b", "comment": "Malware payload (RedLineStealer)", "value": "b10640224217a9efb1253cdef1ff31af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623661807, "uuid": "efccf0b9-1701-4452-8107-5b9981bc4e7b", "comment": "Malware payload (RedLineStealer)", "value": "e37ee735ba2c075bb3ca8ab6a4cbc047600b146c093aa43cc7c7a771b393d487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623661807, "uuid": "5bf12338-9229-4f41-b49a-564adbd89464", "comment": "Malware payload (RedLineStealer)", "value": "58346da63dc0d75a556dcb3db8147c46249fe192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623661807, "uuid": "2276f12a-54f1-4b6c-a96c-eeef2b2cf7e0", "comment": "Malware payload (RedLineStealer)", "value": "79bb32aeb1fb5d4e4c5cec96424d7a9a1449cc2a56ccd5c4daea45d2e3d1727a194f9cde8dca59eda8265a187b29561b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623661807, "uuid": "f3ccde59-b354-4233-9dd0-848c3b67e5a1", "value": "C3E40111B9D09071D171193859F9AB346A3CBD301F348EDBA3D87A2E5E305C29B36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623661807, "uuid": "e3e51d3f-69e0-4392-9f54-0f0d273767af", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623661807, "uuid": "a539eb36-7194-45c1-916d-568c290a8c05", "value": "12288:VOOfN590uu6opX+t4sPuIGPJ112rYvqefXU+468QZ467XKtFYev6DXcxI:YOfNkuu6oLsWI61WqqeW68QZ46jKLYeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623661807, "uuid": "8c6202ef-d624-4a70-809b-3799ba8cd17c", "value": 702131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623661807, "uuid": "89dddf01-9d4a-4052-bef8-3133e030181d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623661807, "uuid": "c1ec24a8-aa6d-4f4b-b444-b4245e7c5522", "value": "b10640224217a9efb1253cdef1ff31af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305efc1d-ccd4-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623649728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649728, "uuid": "b07d0f1e-3d43-4e20-ab43-aaa817317b40", "comment": "Malware payload (Quakbot)", "value": "7f6b83f2777b6d1446cb94b7302e4a42", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649728, "uuid": "5461167a-fbd0-45c0-a4f7-d82d4eacb264", "comment": "Malware payload (Quakbot)", "value": "e3bfd9c976e5c082bed028397be1cea892e33fcd5cad1fbdea82305f6fce788a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649728, "uuid": "c9a95167-2b31-4079-a782-37b842a23b34", "comment": "Malware payload (Quakbot)", "value": "7354dd4710a35a18bd928f225c260da2b9656c34", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623649728, "uuid": "a713fe97-e9e0-4cef-bd6c-6680a9d00e2d", "comment": "Malware payload (Quakbot)", "value": "62533da3c8505687380804da930641c54bef8c005ad9876709f07076f9da1d36f8482e4c38e291596962176cf57490b0", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649728, "uuid": "2b2ce584-c403-4116-9742-c615b6da3e85", "value": "BC74137EE7815AF8C339893EC680A2D48255F1D140A7B32D07CD3618A7532DFEA5D2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649728, "uuid": "5bf120e3-40f5-4389-b080-b24894a046dc", "value": "6144:S1cbRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNV:SSbRMmEv2Bc/nvm8IKABfsYOmauFLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623649728, "uuid": "e499d08a-6254-4228-b111-5daad9e09504", "value": 346807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623649728, "uuid": "3109bfdd-1109-4afd-ab1a-75f9043ae4ba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623649728, "uuid": "6b69124e-d47c-4930-b355-c27a9d7f8531", "value": "Cancellation_Letter_2137859823_06112021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634dcd8f-cd05-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623670858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670858, "uuid": "ae632571-757f-45b7-969b-e4a708657759", "comment": "Malware payload (AgentTesla)", "value": "12222207e63265baa85fd0ef82c9dc53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670858, "uuid": "48947760-db02-44a9-af54-85ddef974a23", "comment": "Malware payload (AgentTesla)", "value": "e4612eef245bb471250b97b7260fe6f5250642ceb8a5342af7420fcd9ef3af9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670858, "uuid": "cb9be1bb-71bf-4458-aaa6-97b759b9e3ce", "comment": "Malware payload (AgentTesla)", "value": "8becd62ff35ec5eacd3d95dda21f2c1f62bcf3f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623670858, "uuid": "94744760-eedc-416b-8cbe-bed5bb2a778d", "comment": "Malware payload (AgentTesla)", "value": "e8d8418b17285b80c868977c95191dba9cce18f2d213f904df8086dd5c34d2b8c75bde53d53831e60020f6aae73aceed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670858, "uuid": "6790e110-05db-431d-a829-7959ed84769d", "value": "CAA402043FFE902AE1735FB79EF577909AAAF5369613F14F2085138B4223B818D52636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670858, "uuid": "846ed571-f3f3-4666-9514-74dfa249eb50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670858, "uuid": "a222591f-09eb-4b5a-a6a0-595a2565f275", "value": "6144:/iYJxYILEwLQ7WrE/hRaHjU/HDymaXfpOsjyX7yA0VzKee/dk5Z6uR8emGJ9RRHf:/z7YIwz3hRZ23RuD3J1d3ed3b1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623670858, "uuid": "34be2217-2848-46f0-950f-a2eb7fcb5c74", "value": 453632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623670858, "uuid": "b93c8828-cdc2-46da-a338-65d4c9299843", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623670858, "uuid": "5da13cd4-c276-4403-93be-326ac442513d", "value": "\u041a\u043e\u043f\u0438\u0458\u0430 \u043f\u043e\u0442\u0432\u0440\u0434\u0435 \u043e \u043f\u0440\u0438\u0437\u043d\u0430\u043d\u0438\u0446\u0438 06.14.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e24383f-cd60-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623709827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709827, "uuid": "649ca99a-c46d-4766-8213-239cb0e029dd", "comment": "Malware payload", "value": "672d03ea2a5d52eaaac669ed0295d321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709827, "uuid": "3e960777-c9a5-4853-9349-4915ed7c43b0", "comment": "Malware payload", "value": "e5885f71c6fb1a072681d448a1baf5c8206887e79cb7900e0eb4246efa27011f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709827, "uuid": "29578a9b-dac1-4e1c-a73c-47c35af0b57c", "comment": "Malware payload", "value": "114f45a9a546e3001fb42eeb03c1375b0a296789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709827, "uuid": "19a89432-a4d6-4e61-b150-e7084d697263", "comment": "Malware payload", "value": "ae97350ddd788dfa7f96fe0a11a459b35f76faaaf8a1d8d6cd47cf09cf1047c9895f7c230fdd0e88a45d6a82cf451e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709827, "uuid": "0467bb64-b463-439a-b936-27d8c7a2ee31", "value": "0C44B843B2477626D1A89C7026ABD12A77FB2D77F21048033AC1BF2767349A77DB0916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709827, "uuid": "c03ec6a7-01e2-4891-8c24-46a9a48b9367", "value": "adaafa2c180eccb7addf1201d12c8322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709827, "uuid": "bd624f54-a1f7-4bbe-b854-564a0388bd28", "value": "3072:a9JmDjJ7Mb+bnPdCJJ8G3j5AZP59+aNHH8JkZLEji7/XfhI52o4:GJm1CJJRj5AP/+aN8mLIO/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623709827, "uuid": "4b6f28ee-8feb-49d9-9d76-8207ef6af62c", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623709827, "uuid": "08099541-2a38-4e64-82fa-00e025297068", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709827, "uuid": "87fcb10e-cfd2-425e-b48c-07ccd0dc66be", "value": "NEW EXPORT COPY DOCUMENT_IMG_JPEG_EXW_32765100214532116_JUNE 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb27dac-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647230, "uuid": "b6765f98-82d3-4867-87b6-b7138998545d", "comment": "Malware payload (AgentTesla)", "value": "24e95178b828482968c6a31970c6547a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647230, "uuid": "a4ee472b-ba95-40f8-b73d-8ce6eb75f259", "comment": "Malware payload (AgentTesla)", "value": "e6ce317d3368fb336f2d2efb78002797975ba82ba0a16869b5e2912caf5731c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647230, "uuid": "e9f806ca-bc62-43d8-9de4-54080ad9287b", "comment": "Malware payload (AgentTesla)", "value": "edd2200f8064b70b22ad65a9b5611a9db0ea3929", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647230, "uuid": "f85f0741-5746-4669-b161-208979913f6a", "comment": "Malware payload (AgentTesla)", "value": "b3366aa7ce2e79f5d6e95c37c389c49d26602939acf776dc0f93decee1bf4963c386aea5505823726def945b60fb6013", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647230, "uuid": "4945322f-7a21-4107-9616-bc8d34c73755", "value": "235512AC722032AEC8A7D4759AB41C25EAB07C7A571B4217A41735EDAD3E587CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647230, "uuid": "a8fdce46-d7cc-4ad7-966b-a9e874d73688", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647230, "uuid": "9bbbfbfd-3eac-44fb-9c84-77810105a8eb", "value": "24576:wNeBUdtOGp7FwCGfjeHK+Cp39DiH0Epkmo55Bt6cSSXPmhJt+ts:wwBUOuZGf6HwJ8H0ErKsM+cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647230, "uuid": "5570978a-0e53-4837-ba65-09216a2baac7", "value": 1387520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647230, "uuid": "80de0de0-5f69-4a2b-bad0-5411fb5250cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647230, "uuid": "b141f65d-eb04-4101-9250-7636d444d5a8", "value": "LS0061321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21834372-cd07-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623671607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671607, "uuid": "5689aa5b-e5a8-43c5-a178-4072f12e0f8b", "comment": "Malware payload (SnakeKeylogger)", "value": "18e109ae1d8892c735d67a389786d449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671607, "uuid": "2410feed-3746-4e93-bc46-9b4df1e9e21c", "comment": "Malware payload (SnakeKeylogger)", "value": "e793172165a87bb32f777ed55818a228c3d89d744416f17f88a1c99cd06179c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671607, "uuid": "92dd7a32-3741-4489-825b-fce130e414c0", "comment": "Malware payload (SnakeKeylogger)", "value": "1cd4470700beb3e907f5d99420f3de128710a757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671607, "uuid": "f9a55ed5-2929-4075-8e93-b932b8e68481", "comment": "Malware payload (SnakeKeylogger)", "value": "c5ab7481d69007be38ee1ceee2259b1adea40147590f96b1aac6494a8983395f4fa6746a6e60fb15bcfe2da14d56cb01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671607, "uuid": "f30ec92f-c1c5-4c9f-bedb-dfe28020d76f", "value": "AC446A6B34CC4AD1E0AD06310DEDF72DBE26AE253D218D166E95F63E587109252F313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671607, "uuid": "47133b8a-59c5-4e1b-a86b-471cce9d17da", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671607, "uuid": "f69dbfa6-05cf-4c0c-ac8a-98b65184923f", "value": "3072:IQIURTXJm7PMIM4EJ5rEAeOE355YPuSuRGMqwv5z/nI8jLDPyv:Is1V4EJZoOEk2SMtI8jCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671607, "uuid": "e456814b-8240-409c-92ec-6db97312a0b7", "value": 263616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671607, "uuid": "915f06ca-9b34-4317-9bd8-b38edaae518a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671607, "uuid": "a297c52f-2374-408f-9c45-ac70a986c71b", "value": "Product Inquiry and specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef285442-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623652625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652625, "uuid": "8645eb5e-f270-4aac-8077-70900fef2b24", "comment": "Malware payload (SnakeKeylogger)", "value": "03f94c24519782903d1cc6c6028aa8e8", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652625, "uuid": "03ea438f-608a-4587-b76c-90b0b999474b", "comment": "Malware payload (SnakeKeylogger)", "value": "e7974dec98e83859811983c9fa120b21447e603c0eb95f94d2e34d6affb45a22", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652625, "uuid": "6f53627b-83fe-4515-ad88-e91b3d38c5fd", "comment": "Malware payload (SnakeKeylogger)", "value": "8718d47c3622d4a4feecfcbc499c761d5f34f7f1", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652625, "uuid": "d5fdf743-8bd5-4512-a39e-f92602fd1516", "comment": "Malware payload (SnakeKeylogger)", "value": "17640a4562f7c7972a706b1f1e1f7c6e1cdbbe8dcd5934fbdd34fac003d9850792960acdbd59814f7486eaba7579b35a", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652625, "uuid": "664d62d4-72c0-4cfc-bf19-0c530303361d", "value": "007422AA7847D70D2692CCD6BF51A9687F1486F130F8120CE3A5873E98D2B9F1236D5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652625, "uuid": "44c97f1f-93bb-4c52-8a46-a8f2a1fcda19", "value": "6144:CRIwYk9/kwhbmEm3zzsxasrK5s1kcnusu7p7UIpZRobzoogdwFpK4nCm3h/mUFQ:lwYk9/bqzSuVcs7p7UIhoIoowPNNx+gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652625, "uuid": "178881f8-2f78-418e-a07c-3b2f5a4fd7f0", "value": 337799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652625, "uuid": "fd134940-04dd-40bb-b119-d0b1e17e6542", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652625, "uuid": "7317aca9-e71a-423a-bf81-ecc9379dfeb9", "value": "TNT AWB.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05a6efa-cd21-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623683067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683067, "uuid": "5d9d7db0-34a2-4be8-8818-763d6558de96", "comment": "Malware payload", "value": "f243d825dbd02584280b0b43ad1ba667", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683067, "uuid": "3f8e5cb4-0092-414b-beee-5d336491e246", "comment": "Malware payload", "value": "e7d165f3728b96921b43984733a92a51148ec87aec900c519a547c470e2a12d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683067, "uuid": "9b419f90-3bc6-4505-acc1-b50bf3353857", "comment": "Malware payload", "value": "0fa6976362753f9e8251006f4a93a59b73e88af3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683067, "uuid": "5aa61c1c-c4e8-46fa-8edd-cbffbcaf0b89", "comment": "Malware payload", "value": "89d3bb7b98441fbdc878819d7680b4facf481a61be962d714dcc6f5d951197c38b57681d2254973991134d38be14c68f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683067, "uuid": "55cf6579-b0af-4182-90c1-4a3ba8a2bdd3", "value": "0D03080C66EA0A91CFDDAEFB447199609631F522D703EF9C0DB546BA2CA3F11C2D941B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683067, "uuid": "7e0b6615-b9a4-4cbd-9bfd-1c80299b8928", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683067, "uuid": "2cce31d3-afdf-4bb1-b6e8-6d0bc5c4cb02", "value": "768:C/wEw0Y6l6oOI0xMOaZTV/A+H9j98WaYyYXYUvmEppzt:C/wEwfo2/M57T8dYy86Ebt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623683067, "uuid": "30eef9b6-9be6-43ae-883e-35342c725262", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623683067, "uuid": "3e80cf47-1ec9-42d1-9179-d9f549a23876", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683067, "uuid": "0ddb2c25-83c3-44cf-ba25-885fb4794a5a", "value": "93e69b15-f4db-4aca-9738-e3bbdce3fec1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f1f39c-ccb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623634846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623634846, "uuid": "dd9712dd-7133-4366-a93a-061a2fb5ea42", "comment": "Malware payload (Formbook)", "value": "1658a7feb355040712003b8b126096ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623634846, "uuid": "4bd3bd91-4582-40f4-9f37-51eaa20a58f4", "comment": "Malware payload (Formbook)", "value": "e7ed41f872586d57cd292eb9182a34449e8da70466a443bad09585e99bc6fd90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623634846, "uuid": "d167570a-bf64-4f33-b5ed-01aacfd5d0a9", "comment": "Malware payload (Formbook)", "value": "f662e5294e18f5fc2c9d3dd32a2683665a0b2b14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623634846, "uuid": "209ccee5-f710-4aae-b6a5-6c21a647a9eb", "comment": "Malware payload (Formbook)", "value": "c308df4dcfc356c1bf1a11cb23b0b5744dc9e820490baab0f98d1fc05db065801e71642d8fc6af1de44b33d4b101b6ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623634846, "uuid": "c40b9534-d571-4120-9f24-a9eb1bf36bdf", "value": "76E4232963A01231D03E2372D6F561480AF9FD116A67DB5D5D4872B82F3773286CAF8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623634846, "uuid": "c84670d9-9100-485c-9ac7-380f34dfe9da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623634846, "uuid": "3062a77b-8f54-4bfc-a255-b44fabd1de8d", "value": "12288:TEfMZM4e/ZUdtbtAFU2jgIVkZ8tQuFQFT3iBgoW/mL3VjxYVScTB:TEfMNeBUdtRwjdVZ2Z8gL/EliT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623634846, "uuid": "9e79a486-246f-44ea-a01d-046a48c9b79c", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623634846, "uuid": "9cb9a9f0-b2b8-4321-987b-1853ec7b2a7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623634846, "uuid": "6647c969-9bee-4a81-a20f-98a001ee7de4", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.1196.18366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e103bc-cd08-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623672200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672200, "uuid": "36b98056-fc96-442a-8843-1c05e1446996", "comment": "Malware payload (AgentTesla)", "value": "85e5901d7d8860bb6e0048d42d8a5a93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672200, "uuid": "f3ad72c1-fb02-4539-afb9-944e72380ae2", "comment": "Malware payload (AgentTesla)", "value": "e8ac3ec1635db76942a09b304a3588e68a54211bc87409d836d52c2d7ad4cd98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672200, "uuid": "ad9b4226-d752-4f42-9c14-108207004159", "comment": "Malware payload (AgentTesla)", "value": "a2564efbfd79deafad23da865ae7f049babe4e7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623672200, "uuid": "3f42bcef-bb50-4629-9137-42b13e3000fe", "comment": "Malware payload (AgentTesla)", "value": "97872967e3abce562ac7517147ba6b6377c6869768908fee079f933b959b594e0c468f50fe054b32abd57e412384911d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672200, "uuid": "69a91e4c-86b3-451a-88eb-521444dbf7cc", "value": "2F9402142BBD802AC173AFBA5EE8B79ADFADB5336816F44E1951134F5663E00CC52237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672200, "uuid": "742711e1-f5b4-4b55-bc8a-1f7e45935b09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672200, "uuid": "c54da52b-4918-4baf-8433-8f30b4ea2772", "value": "12288:7QsjZ6JzIAN7FjPyvwlS5SGbMI9fizXbuc:HZSsAnj+X51bMIlizX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623672200, "uuid": "3431445e-659c-4688-baac-257a3d79f5a3", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623672200, "uuid": "a5be82be-3032-4376-adff-a2917829ec9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623672200, "uuid": "ba52b040-5c6b-47ff-b7d3-a7d8453bb1d4", "value": "FACTURA Y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b022508-ccda-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623652376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652376, "uuid": "1b0353ea-1330-4569-9329-1f8dce259209", "comment": "Malware payload (Gafgyt)", "value": "5d4b4a77b1acf09fdef22421a74f4e20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652376, "uuid": "1c5b55cc-b476-4900-b262-6337c16bf4b5", "comment": "Malware payload (Gafgyt)", "value": "e9d85a64920d487cd509d3131735ffe28527fd170d00fd197f0e7418f6f14d76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652376, "uuid": "2192f7c8-ad31-4697-bfac-c47fee11bf93", "comment": "Malware payload (Gafgyt)", "value": "6c4b94f56d1c86c892392466a956e37d2b50405b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652376, "uuid": "c2603e6b-b25b-4b80-856f-18ac000f5b59", "comment": "Malware payload (Gafgyt)", "value": "6bb4bbd5b20922982fa050937f0331f0b9be7e864a8ed749af8d483ed99f3a589657e3596a459013752f3016868f6abb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652376, "uuid": "9ee1c1dc-e6e6-485c-be53-87a860fb2c50", "value": "C5D33B05D8909767C6D227BAF79E428D73236B68A7D733115A28AFB02FC1B9D1D7D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652376, "uuid": "bbb40155-361f-4ff0-b6c7-f4c2a84f52d8", "value": "3072:IVfyQ+d+pceQGftb3za5fJhWOiwTteOHX45hLMO3K4G5ZZPMmydQCYMhEFg:ub3za5fJhoIHI5hLMO3GvkmydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652376, "uuid": "368a8148-d7fd-4174-8d71-3c05d1fd08b5", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652376, "uuid": "b574942d-4e07-4a6b-be3b-9d47a01564e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652376, "uuid": "a176793f-c0d2-44a8-b54e-01b516158c54", "value": "5d4b4a77b1acf09fdef22421a74f4e20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09344a1-cd37-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623692490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623692490, "uuid": "b8dfdc66-ebfc-4db8-b842-ffa321e3d3ac", "comment": "Malware payload (DanaBot)", "value": "6f5910e79ae771bed168aca6be422a8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623692490, "uuid": "282a087b-7397-4068-9e57-653ea3a2a6ea", "comment": "Malware payload (DanaBot)", "value": "eae0803cd488c0649931c48e816c807dd1c6149a9f975dc68189f600af403114", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623692490, "uuid": "55c01963-c742-4a89-9ef9-85de83e3c7a6", "comment": "Malware payload (DanaBot)", "value": "b5eb4fe8c5a47d16b63edaa20a39c5ac17a084ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623692490, "uuid": "71c98377-7e76-415f-a36b-36c33795e32e", "comment": "Malware payload (DanaBot)", "value": "9a7522b0fa6848edfce54311859bd609cbc8ddc72400cd90d6bb863660736ee510d17e9ca64b4f61829d048e12f50d98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623692490, "uuid": "e4b08472-3780-4e34-b8fc-0706a0e6229f", "value": "55563321F660C0FDF4B301FCDA399FBDA959B8E01B6950EB02E609D961A75E09D3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623692490, "uuid": "4f4f4ffd-ac41-45d5-a7a2-a852bf904510", "value": "65cee1cc96d935afa5d7eb55e18fefb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623692490, "uuid": "09a20e49-069a-49df-9d7d-604d1d885d8d", "value": "196608:5jbzZ+CDtwFk/eox4KngIvEcisH9bJYv+Wvsw:5fzZ+CpwkeoCKdtb74k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623692490, "uuid": "13f1b663-d7d0-4b18-9112-5c3b5f64fda2", "value": 6352384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623692490, "uuid": "4002840b-bb58-4de3-b4cd-bd5b6e541b52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623692490, "uuid": "95faa452-d2e0-40a0-9b45-75cd8c33b25e", "value": "6f5910e79ae771bed168aca6be422a8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9891b3-cd07-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623671631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671631, "uuid": "dc67369c-ad14-40ea-bfda-f39acb10bc9f", "comment": "Malware payload (AgentTesla)", "value": "836509d9db19ef1f77718ccc535e4cb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671631, "uuid": "483efcf8-30d2-45ec-a4cd-d703c3cfc556", "comment": "Malware payload (AgentTesla)", "value": "eb9fe1f38a211adc55c6367d6849b8987d50cf26119991b1be5bcfada666c69b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671631, "uuid": "2461c058-9ca1-459b-ab74-98d6e5487684", "comment": "Malware payload (AgentTesla)", "value": "fd7ebfbd4d5adc358404bcb830622d23d211ae86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671631, "uuid": "bb276ca2-fa04-4611-a373-078eb6700607", "comment": "Malware payload (AgentTesla)", "value": "a3e93e44f08292faae094e8c4fe23968db4b26c1f47bfcf8c8da7dc08762e89c68f82d02b34fc1b8c4f9fdbcdc4541b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671631, "uuid": "81f4755f-48fa-4897-989a-80ea68e1c313", "value": "B005E12523C88B55EABE4734D268418053F1BD1BE329EBCDBD9A14CD0BB4F81876275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671631, "uuid": "77f959a7-c8ad-48bb-b01a-a98032e3bfa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671631, "uuid": "7cbfce52-131c-4412-b3f5-852faf5dee94", "value": "12288:Pkll9eFnaTLMz/HfcoNhRg3Zg9PsIAgML4aFDhe8BlV5ps7YcWnPX/lRJNx9VCZc:cllYFaTLMz/HFdkZhgMs8F5Pc+dzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671631, "uuid": "dd745073-dece-4db1-adc2-addda5ba4e44", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671631, "uuid": "f45cda49-a42d-449a-9a97-76c16aed4e2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671631, "uuid": "0f503d6d-59c9-4ca1-bf67-10b13c7b405a", "value": "Scan_Doc_8865443419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef2dc31-cca5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629539, "uuid": "4b06f11c-e6fc-445a-9690-de589d0c652c", "comment": "Malware payload (Gelsemium)", "value": "4b51d56955a4438481f8452120a36aa0", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629539, "uuid": "ab976daf-8b8d-47f2-87b4-3aff45fe4da1", "comment": "Malware payload (Gelsemium)", "value": "ec491de0e2247f64b753c4ef0c7227ea3548c2f222b547528dae0cf138eca53a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629539, "uuid": "0f1b3a2a-3d08-4c6a-876b-aecfa5f20b88", "comment": "Malware payload (Gelsemium)", "value": "cf4210f762798486cc9d4911d2d9f0f6b2bdf687", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629539, "uuid": "19e7f26e-830c-4b72-86e3-5939634c959c", "comment": "Malware payload (Gelsemium)", "value": "07444eb8be24c3f6d45cea155d745be5495cccbd4cf34cf8288b1dbfdd05dded0a6edc1c904fafdc6bb178259f8b21b1", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629539, "uuid": "8f0217ac-e6bf-46c1-92b9-49955316b029", "value": "7C345B3DA7A619D4FC37E936CAD6A207CA3B35721B11CA9F454043068F37981FA63D26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629539, "uuid": "66f9c3a1-70f5-423c-b552-c22b68f0285d", "value": "70694a54d0aaeb5c36593e897ba0445e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629539, "uuid": "563a6caa-7eb6-4738-b95a-304bd130139b", "value": "6144:UqJktmVRbxGml/ZYPilzMVneXYtR4Vme:FJNHd3xVlzMVeAR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629539, "uuid": "f87f5b33-118c-4721-9ddc-7aca23c074e4", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629539, "uuid": "bee7b341-e9f6-4edb-88eb-8c26c551ecbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629539, "uuid": "b8dd2914-4e5c-418d-9f32-9a453c5b8f28", "value": "ec491de0e2247f64b753c4ef0c7227ea3548c2f222b547528dae0cf138eca53a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5e1991-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623654742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654742, "uuid": "36bdb499-ba03-4093-8e3e-b30ca7b53472", "comment": "Malware payload", "value": "324dbc716ffdd7d23faf7c1781628685", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654742, "uuid": "cfdd16fe-10f5-4ce1-9f00-205457040664", "comment": "Malware payload", "value": "ec56b39a52a72a75b446660019cd81b6712e7876cfe8cffb37ce6a666e8b9dad", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654742, "uuid": "27e8ca16-dd3a-42bf-b274-47ec9eec707b", "comment": "Malware payload", "value": "b1ec1b24a0c29812e24be0a20123532b6a54ba3b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654742, "uuid": "dc270305-8cc9-4194-9713-dcf7c41a0734", "comment": "Malware payload", "value": "68b543018f9602a609eb4ea7772dbe1a54b8382dc3c66e49c575c0a0751bd033b110fa55bc8f747b8c64157079648c45", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654742, "uuid": "30f2fe7a-52cc-4321-ab50-531e38d56cd5", "value": "19D42300970119FB9C28573EAB15AE4CA84E0DAC56478FE3DC749E9E7C0A9C522EDD1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654742, "uuid": "70e95d5b-8658-4439-910a-64c4da054f06", "value": "12288:cdUFpUQ+RNgRWz9Zr0g17MvRdWZ6R8eja4xxvMBOdgG9+hUVlPW:AUEQ+7g6H11Oj2Wjb/EBOd1EoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654742, "uuid": "bda5b395-4916-4e1a-90a6-8c6cafe9369d", "value": 641886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654742, "uuid": "42e9292d-869b-472a-81b7-d43668e415bb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654742, "uuid": "df92781a-c5fb-4e89-8d27-2646474258ba", "value": "Mohamed Abrar H CV.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862029f3-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623652019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652019, "uuid": "a87ce41e-c055-45f3-b2c1-0190b28eb040", "comment": "Malware payload (RemcosRAT)", "value": "d363e0aff8c0138405fc7a19b7582621", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652019, "uuid": "d1b3984d-b86c-464d-a30c-97902948dfe1", "comment": "Malware payload (RemcosRAT)", "value": "edefbe5cf338c7f3b482c01ff145bf32606083ae3118cdab9f3f602511d1aa89", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652019, "uuid": "e3a97c97-d342-48da-bd40-1a23ebfe4ff5", "comment": "Malware payload (RemcosRAT)", "value": "32f47d2656822336dc9e647a736f6e5bb4b24e43", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652019, "uuid": "df999fe5-77b5-4e1f-b00f-e419877bc9d5", "comment": "Malware payload (RemcosRAT)", "value": "c123ff2c01b1bb017f06e1cb32c1bc6e4848594926df4f67fc0c7ec798a7eb1e0cbfb884dd5ed3c51f210bafbb13adab", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652019, "uuid": "925e23ad-67bb-48c5-a398-65ef6e2b2666", "value": "0BF4333FC6A7A4B2E1CD4E3E7250341B970D63EB6EE0109BE1D4C94A8DF12F99E10985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652019, "uuid": "ff6d8421-b1f4-43a8-b1ab-56455c5b5dd9", "value": "12288:SrK0QYYDOw5q8M0kwUw5V9+XvcG/VbgunmbIu6cg7MlX4Jv/v57wXy9+RTrpC0:yKpY2L5q8Mxw5SU6r3xcgQlUv/vtiRTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652019, "uuid": "ae7f0ea7-8ab1-440a-8f53-3077fda4488c", "value": 735202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652019, "uuid": "bad06e03-3f99-4d95-a4d9-2ee14b7b2287", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652019, "uuid": "cf465e21-056d-4c89-a0e1-78b384a89983", "value": "Payment Confirmation 2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55983d45-cce0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623654944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654944, "uuid": "0ab89c4b-fbfb-40a9-912d-ebf50799ddf2", "comment": "Malware payload (AgentTesla)", "value": "ec22f28ea1853bf8971d0f5673548b8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654944, "uuid": "fda0a244-a761-4b9e-af08-e46bb310d1b7", "comment": "Malware payload (AgentTesla)", "value": "eea69b395d1ba3300ece756b31aa5e9fa380f11be00f02dbad7d07bfb4658a26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654944, "uuid": "7837eb02-4f1b-4077-a022-7a1f15c2745a", "comment": "Malware payload (AgentTesla)", "value": "fe64bc8ebc44021024dc281572f9e66afc788206", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654944, "uuid": "a6788018-551b-4132-89e7-67e95ab74d0b", "comment": "Malware payload (AgentTesla)", "value": "aa31556ed9a2eccdc3cbd0b70752bbe021385b748767720894e3c67c962940ecafafbeaf0d817683b93aca1a8c8439fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654944, "uuid": "dce411e6-af62-4f31-8add-ca207881b37d", "value": "1EF4022063BC6B22D4EE97FE917065600B39B562AC11C72D7A9134FD0AB77D0C9D1BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654944, "uuid": "d900151f-3297-4d29-bbe8-28c4d402b984", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654944, "uuid": "b51ee318-5fda-4bb9-b066-fcfbbe24312f", "value": "12288:PNMkfujJeBGtc0oiyxsy2NvDitI6DY5JzRoCY+gdTViRcpA38WV3aUXgeXIpiE0/:wy6ySejY5MFbScOtV3aUXLs105Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654944, "uuid": "44b4469e-e133-43ba-b77a-1de6c8cb1bab", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654944, "uuid": "7f63fa19-06b7-431d-9af8-ed776799157a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654944, "uuid": "0ff6ff39-45cb-41e3-a4e5-9495472662b1", "value": "fpccHIAWusmio6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f12da1-ccce-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623647435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647435, "uuid": "cb8b6e3b-89d3-4690-bb2a-133f60e5fcbe", "comment": "Malware payload (AgentTesla)", "value": "bba9a981e6fa97c0d2b0a771653efe23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647435, "uuid": "3c947f3a-eda4-42d9-8a0b-ecd4ba8e3835", "comment": "Malware payload (AgentTesla)", "value": "f085a75ddaceab9aec2662368a1545f9d7d185ae39b09a1a342a250437f61f9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647435, "uuid": "c2da4d95-45e7-4302-a586-3038faa2dea1", "comment": "Malware payload (AgentTesla)", "value": "ce85e5051c1bd806e24923dbaf195a5025ef3d87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623647435, "uuid": "ce6e392c-de12-4326-b325-30256ed3319b", "comment": "Malware payload (AgentTesla)", "value": "f7d31b7505a21b03314040d2a3e6462908ebfc1797cc329fd5948245c719a7e8739e8c5d8536966b70020e9dc68f50d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647435, "uuid": "8047715e-74d2-45a0-893f-80306b6d39db", "value": "CFF43371584C1787FC5E5A02CC22E8425E3398E8DA1BB6F96EF5D56E80C27E0AF8F151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647435, "uuid": "e7d5d768-cbad-47eb-bf91-d363beb8cf5a", "value": "12288:GHge1BHOPaEao4RQ4aCAfzvXN6CQ/lP/SuALKwul/iuxlypVF03sjVMCXlMMiTpG:GHgeTuPaFzaBjXN1Q/0dKw6/hI90oVM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623647435, "uuid": "b5774ad2-28c2-4323-b12f-8932193cb934", "value": 754081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623647435, "uuid": "1fb1f1e1-33bf-4611-b2e7-ddb8ceac0e4f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623647435, "uuid": "0fba5a5f-8c35-423f-9983-c5ad5317bfaa", "value": "Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ffb182-cca5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623629470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629470, "uuid": "f31e8a28-1a10-4216-a8a4-05f68cffa0d7", "comment": "Malware payload", "value": "24fff48947a8f5a100e21d5592f92d4c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629470, "uuid": "5ece61b9-cf8c-4d82-9549-7eab7614f7dd", "comment": "Malware payload", "value": "f0d23aa026ae6ba96051401dc2b390ba5c968d55c2a4b31a36e45fb67dfc2e3c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629470, "uuid": "7ef9d694-7f91-46d8-bd6a-cf330465bbed", "comment": "Malware payload", "value": "239db66faa803772f2a8905b1e77377a5bf78351", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629470, "uuid": "94d6c380-3c95-4c5f-92a2-adb94ccbb712", "comment": "Malware payload", "value": "5f96e54c931483a1420768ccc67ccfa6c1867150a9b70a582690215570aba2d8c8e211a110c6f962b49cf2d2e2d820f1", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false }, { "name": "Gelsenicine", "colour": "#C1993E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629470, "uuid": "2213b124-8973-4ac0-bb07-ba56ccdf6555", "value": "1C932D116FC4A8DAC09315FEEBDF9A7FB73C06F9269267D221985084BDCC819D6A410F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629470, "uuid": "35765089-afb0-4425-93ea-2b7d0d7e8223", "value": "4208a4fe7383aafb3e22dedc452b5527", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629470, "uuid": "33c6d4fc-17a9-4810-a4d9-09b6882aee09", "value": "1536:X8zGZzLJwUEWBZWTNk7XU3rRyCjbOJ/b:szGcIuTN7R1Q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629470, "uuid": "63930769-d161-42c7-801b-8f4e6d27d561", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629470, "uuid": "37c34d2c-b175-46ce-a5fe-643f7ba2a652", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629470, "uuid": "2a10739c-86f8-4ce7-9e71-486703d1f7b0", "value": "f0d23aa026ae6ba96051401dc2b390ba5c968d55c2a4b31a36e45fb67dfc2e3c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98050151-cce7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623658062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658062, "uuid": "1b803c3c-dd4b-45b3-a913-3bd86c96c5d5", "comment": "Malware payload (AgentTesla)", "value": "2a0dd358ecd6f2d324af5d8f662ceed3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658062, "uuid": "63ac4c28-cd7f-4e6d-9728-a21e8c9c7eba", "comment": "Malware payload (AgentTesla)", "value": "f10a1fd4fedbf220dd6352bb5dbc8a79647b09dc6a511eadb1c5ad069c98dd3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658062, "uuid": "c30a1f93-6f51-4b29-b374-97368d9499cb", "comment": "Malware payload (AgentTesla)", "value": "5d60faf00fc11e4e4b127df021d59f353b4fbc85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658062, "uuid": "cca7d2da-638e-412b-bef4-66c6063a4853", "comment": "Malware payload (AgentTesla)", "value": "97f2d6bfbba58533a4b07a549f5b298339b8467400bdf2c37eba1f70d9d509c650d426267c47f2bddfb4d8b2b2f04bd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658062, "uuid": "66044210-2736-4425-976c-26a41fe02bd5", "value": "7605E11623C48B95EA7E0734D168019093F1F81BD729EBCDBD9914DD0AB1F828367B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658062, "uuid": "e4993a6f-62e1-4bbd-81d6-304760e6a35e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658062, "uuid": "90371ec2-2e2f-49af-a035-ca865b6b0019", "value": "12288:X+9P8JeXQaTLMSy56S6B9XZBy02vSR/L7zlC3kBIwj5SyHfLJWeTGtGVq9VCZ6v:X+ZHXtTLMS++Zivm/oUJjsedWeTGt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658062, "uuid": "b3508e3b-af69-4fb8-af24-475018a216b7", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658062, "uuid": "2dff7f45-c47d-48d6-a1e9-39e25478ead0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658062, "uuid": "2f946653-06fc-43c2-ac2c-3f3d216d6215", "value": "Solicitud de cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41df8a1e-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623654481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654481, "uuid": "23b8e1af-2cc0-4991-b63c-1ba0899671d7", "comment": "Malware payload (AgentTesla)", "value": "dc0dc5e8482b6258b88f0ec872adddb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654481, "uuid": "d6292e02-fb6e-4b27-a991-8302732d5ae3", "comment": "Malware payload (AgentTesla)", "value": "f1926247ed0fb752a7e50c32e4cdda49b46774b7e160a7c3ccb98b9e3da20521", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654481, "uuid": "c9bbd657-4111-441a-87e6-3dc31e5efed0", "comment": "Malware payload (AgentTesla)", "value": "667c1cd451283acd951ff7e7bb0349b2f591b614", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654481, "uuid": "fac56d79-318a-49cd-8b55-9bfe9543838c", "comment": "Malware payload (AgentTesla)", "value": "7cb93516e038dfea436766dc3bc0f6be52fd3b9495e9fe9ceadcd1aa28ab53b0eea838c462d70d2e830253b9f9af5abe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654481, "uuid": "e61c5df9-0ddd-4176-a719-e7352a9a7fa6", "value": "62158CF4F198ACB1D59EC771C6909CA9DBE156FE52438A2C0EB4CACC1F0378A8F5A445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654481, "uuid": "3510a72f-1ed7-4078-810a-7d0fd69f2a3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654481, "uuid": "63fab142-83f5-4826-8086-7284d55fe98a", "value": "12288:glBYEaHZWYhwTuflez3bTvTIRFlMjKHFF9xKIuDdrE6tyctTRSso/zA:yYEa5lhwTuflY3URFEKlFbNu/D6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654481, "uuid": "8f11dcb8-4e99-4f3e-a753-713e22b34e7b", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654481, "uuid": "ac435393-1892-4a9c-9c54-25165494902e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654481, "uuid": "a9ad6731-6b9e-44c6-8da6-988933036078", "value": "HSBC payment advice EGHKEB0C01725410-T02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b11d60a-cd22-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623683220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683220, "uuid": "df69ca26-a165-4912-93c2-cdec00699bf3", "comment": "Malware payload", "value": "b070305b1133327aeac84a2f0d2f42d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683220, "uuid": "54d7924a-99b3-477f-8876-9a01dd652ba7", "comment": "Malware payload", "value": "f24585fecd557c5c193e58d4f60f367970c4176be5d9df25472e44ac874a0ca6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683220, "uuid": "0edd6dba-b9d7-4f52-bd06-25e6cc9ce935", "comment": "Malware payload", "value": "c383215bf1948554513d7c58b997c62635a48331", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623683220, "uuid": "3294204e-d8f1-4370-9193-763c144b2fb2", "comment": "Malware payload", "value": "18c1158843c477c68de825a7688d1da68e63178e378c1fe97b828e92541ad7798d4524e19bf228cb06db606bb930624e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683220, "uuid": "402afdef-de29-4bb7-8fa7-e66c1446a1d9", "value": "9BC185A31CAEAE470B143616C7CF76C1071FCB104B966DDC10CB69A8901BE5BADD4E5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683220, "uuid": "16c1d07d-bb42-408e-a452-c2c9df3283d6", "value": "96:9TDYiG+7mLv2G+rgv8HtkKPd0aNiclHcVCkoZX10QlhOHQ04FV7:9fp97mLeFgvwGGicBhzlhOwnV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623683220, "uuid": "62c4b436-2ac4-447a-9e96-67f879752039", "value": 5754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623683220, "uuid": "90b7b82d-0efe-40dd-915e-c6770a3441aa", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623683220, "uuid": "b817d4c2-af2d-46c3-93c4-a2d06136fe6f", "value": "PO No. TBQA34320212129 DT 14.06.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99239e35-cce0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623655057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655057, "uuid": "bea16908-de08-4cac-b76d-c6c1e02e4164", "comment": "Malware payload (Formbook)", "value": "bb97d34fddf332ca03f69c16dc1b3ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655057, "uuid": "c6fe7649-09cf-49f2-a4cb-73cfe40a2633", "comment": "Malware payload (Formbook)", "value": "f2d382ad3eba8f9911837369359508a3cca7d3757de74b1284e4d530937b6f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655057, "uuid": "046b85a9-a7eb-4884-93a8-2eafbb6aeee7", "comment": "Malware payload (Formbook)", "value": "1c5c320dea0b4113c29e159fc69f71e483134cdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623655057, "uuid": "d2214950-11b3-4705-9165-f46000ca5fb8", "comment": "Malware payload (Formbook)", "value": "a1aa5311cdceb4bc81a748366a4d2cf44b2bf55bb40888abd940b0fa9c06b8e58f23875fc9bb7ca4e20db4788f80c51d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655057, "uuid": "4f5032f9-5f8a-47dc-bde0-28f12c4a4efc", "value": "7605E1B12384CBABD76D0975C51663C183F28643620AFF9C3C9A28EC17C27467796B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655057, "uuid": "1fad5164-6b65-483a-a259-a5188479ec40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655057, "uuid": "1aeccf77-22ae-40b0-8aef-c3bf19425118", "value": "12288:dBOXamCTLMQrkTuLLvGLN/vzgtK72rDmVLzkmZ22YZLoPZ4SI9VCZ6vO+2:dBO6TLM22UKGsWmVLz/2jLoxyB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623655057, "uuid": "aeb7161d-f71e-4c9f-aa4e-f6eb502e70a1", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623655057, "uuid": "5e36bae2-defc-4bf5-925c-62385ac3f45d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623655057, "uuid": "892ee6e5-25b5-40a6-9dc8-890d3b1248be", "value": "Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9060c443-cd28-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623685966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623685966, "uuid": "4c70f191-e852-40c8-81ee-09e16d222bf5", "comment": "Malware payload (AsyncRAT)", "value": "bf7b01b358903416117bc4de8e0861b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623685966, "uuid": "64105bd1-1134-4f07-bf78-5f2488f1be93", "comment": "Malware payload (AsyncRAT)", "value": "f2ed40ab9c2eb52484d79b485a78e2779dd300b7513eac17ec4e39fd4a9614a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623685966, "uuid": "9bf44a39-5953-4b10-9393-f02d6ff1b0bd", "comment": "Malware payload (AsyncRAT)", "value": "823f0f10fe938504503a8331e4f890b15f123ad8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623685966, "uuid": "b401eb8e-6da5-428e-acff-dc414df4cbdb", "comment": "Malware payload (AsyncRAT)", "value": "760568e8214b4c6d7c908f0156a525e1af721b51b4f0f60f42d8bfc7200aba454481ecb30a26c7ce680777f679f1383b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623685966, "uuid": "045584c2-2133-4738-b70b-71e6881bda3b", "value": "A614AE42B79A8731D5095972C5D7593103E7E7CB2673E7493E8C02C61F02BEE8E99B88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623685966, "uuid": "cd90f5cc-56f6-4563-bc3c-a070a48a1261", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623685966, "uuid": "de58f96e-3561-4ca7-bbfb-d9b13c3928cb", "value": "3072:roMgdkKzePs84KnobXZRQt+YXX4K7jOUplSZ9z6ppDwWHn4vWq9iqegiR+U8dKNo:0MScBHwW7zpo9eV94vkxChWc6P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623685966, "uuid": "69409214-0443-4cdb-b3a0-09cc7bc5ab5b", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623685966, "uuid": "f65b4ccc-1ffb-4416-80db-4ae0cfbf7087", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623685966, "uuid": "ec72197b-3f3e-4382-8507-4581f787dc01", "value": "bf7b01b358903416117bc4de8e0861b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0aa4b38-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658560, "uuid": "49be9b32-d411-4312-bf1c-14daf63ded21", "comment": "Malware payload", "value": "40daf897446b2c540d0fd8821b4b11a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658560, "uuid": "8a7d4135-4c87-4771-9d36-45c189054e02", "comment": "Malware payload", "value": "f3135a9b5ffcd2f7abe4d9ad51a3deb7a4c7493e6a9e24a54820894c8b7ed500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658560, "uuid": "2566591e-6ef5-4c02-9976-0402302a7621", "comment": "Malware payload", "value": "e9888bc33643f968da40ba040769dedc5144414b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658560, "uuid": "8a85d7bd-ec5c-4667-b96e-a80740cc9824", "comment": "Malware payload", "value": "008fcc2bd15a9aa67b2bae633c501af5e7801c45deb0bab46118bf57b6e479444d89bde91ca6667f5e17ac83271a87c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658560, "uuid": "8e5cd8f0-244d-4f6f-9860-7affd7de1b04", "value": "170502006690C0B4F4FB16F5697ADFB996BA3D70A76864DF12D51BEA13386E0AC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658560, "uuid": "f62661e7-4f20-416e-95b9-c3105f410024", "value": "f3b31e907320cadf5820c6eb76eca851", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658560, "uuid": "ce4a62f5-eb6a-40e6-9d74-a1ef02d00262", "value": "12288:kBt3GMoAOLmUNfVcE/B7tHcclybzLgLJuEhILOCV5SiE+2y4O8jp1q1ydI1zI:kBt2pAOTcE/Phl+uuiNISRHy4Jpg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658560, "uuid": "a3f7b500-4028-4e51-8fc2-89a93f92d4c5", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658560, "uuid": "4eb9fc12-2ebd-4c62-992e-1b845c3a3cab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658560, "uuid": "b33e208e-dc55-4780-b1a9-9cd4b3bc2170", "value": "40daf897446b2c540d0fd8821b4b11a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6243214-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623658542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658542, "uuid": "f1eda59d-5d65-40fc-8186-f05663c2edc6", "comment": "Malware payload", "value": "2c54ae3da64606e33f1c5cc69682ac9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658542, "uuid": "f06c2abe-fe20-4c1c-9876-da30a01cbb16", "comment": "Malware payload", "value": "f32903a5171c64d7cb930258df364dd7c16b7417736b7bd4c12285938b6324ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658542, "uuid": "4dc6da61-0cda-4ed4-8b7d-b98ae2506bb9", "comment": "Malware payload", "value": "db6665a3ea97a7ebd2e4425e72c0e2c6e8fd839f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658542, "uuid": "823c13ed-032b-449f-8a6b-0a4113460501", "comment": "Malware payload", "value": "520b8c17e3f7f66c3854c7314a0a7d7860bfc93dab3ee8fd3169e9a5c5d8cede2503df5e56c68965704e0708f98ca0ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658542, "uuid": "48a08091-186d-4e35-841e-8063c0b3b919", "value": "BA0502016791C0F4F0F752B55C769FACAAAD3DA09B3851CF52DA1AEA1B346E0AC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658542, "uuid": "ef8bd5ea-798b-4bd4-93b0-db98f4eb5185", "value": "baa7acc629fae892f4f615c8c37bd06b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658542, "uuid": "3fff1bc5-f7ac-413c-b906-a629f04f7678", "value": "12288:w8yqxYnLxC0FWkVk/6T1VR9xI8vB/zImvatyvc7Mv+CfmXy2MGEtSHDMBHUzp:w8janLYyI89Zvatyvc7k+NC2OtSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658542, "uuid": "748cf9c3-227e-4fad-8f00-29c0ee730178", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658542, "uuid": "b8d3cc5e-3db8-4da9-b393-b51e0ad1062d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658542, "uuid": "a22d0fb5-fd1d-4eff-87a0-b3add0b70bf2", "value": "2c54ae3da64606e33f1c5cc69682ac9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ef2c33-cd5f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623709764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709764, "uuid": "9e452225-d297-4a3c-9c51-cca7080f50da", "comment": "Malware payload", "value": "13fe879d4b0acd6b10e9e4db7fcf3a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709764, "uuid": "2da6f63c-b7e7-4033-b1fe-79fb362f9657", "comment": "Malware payload", "value": "f3a520aa6296de59468c3a38d45660091097c056b7249a66d3443f3bd4ecf997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709764, "uuid": "f4843c03-669e-422d-88f8-66cf467ebc12", "comment": "Malware payload", "value": "c513f61b28a5602768fc3a07bea6efe0b743dc26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623709764, "uuid": "ad448e43-a5e1-473a-82b3-497d49523bab", "comment": "Malware payload", "value": "72569e1b197b413646b11557ae82d6c343c476defab979b9c581df1f25694e49bb38cf61bdde098f7704c95e753dfa79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709764, "uuid": "ea1f2952-f117-4b22-8472-6aae6a5bec90", "value": "3544C803B2477626D1A89C7026ABD12A77FB2D77F21058033AC1BF27A7349A77DB0516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709764, "uuid": "adb64b33-8a18-406b-87ce-1d8e9b00e0c1", "value": "adaafa2c180eccb7addf1201d12c8322", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709764, "uuid": "3c3d066f-ea99-4a90-b713-d720f3886acd", "value": "3072:HqCxEJQKX+an/XCf1Tth5P9+Zz3YaXygA1kkX31Z902v4:K3vCf1Bh51+Zsjgqdl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623709764, "uuid": "81db395d-ca36-4972-8620-6caf00593d32", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623709764, "uuid": "f34382bf-f110-4bf6-92e2-32046e9ce297", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623709764, "uuid": "fc87ee82-e980-4fed-b364-eb1014ef0b1b", "value": "URGENT SWIFT COPY FOR JUNE 14 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ccdec6-cd3b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623694275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623694275, "uuid": "51c7c59f-0994-4b9a-9c65-5a4fd569d605", "comment": "Malware payload (NanoCore)", "value": "e5fc908b43a9096e833093739b2421b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623694275, "uuid": "c08dff36-23fe-4352-86c8-2ca7f3c31a36", "comment": "Malware payload (NanoCore)", "value": "f3fff803ee0de9a5c086d197d30f47eaf79d01b6fe6eed69409a63a8dff8f79f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623694275, "uuid": "5b1f94f5-f178-49f0-9e75-7a3e969e590f", "comment": "Malware payload (NanoCore)", "value": "bcc831ba46d1c0947857fab1db0c905a565f66c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623694275, "uuid": "d45a8c8b-b21e-4bf0-8f29-277d7dca6f0c", "comment": "Malware payload (NanoCore)", "value": "db6d6d4cd929d55e363f76f387c1f4ae182227991c202a48966b044806fba3fda36936cc3e5caf600647c001a318edf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623694275, "uuid": "3f26f9a3-496f-4425-a207-db5190864418", "value": "CB15E12623988B95E97E47389169019053F1F82BE725EFCDBDD910CC0BB1F81876276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623694275, "uuid": "fff0d2f9-fa61-4fcf-93d3-df0720441293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623694275, "uuid": "53ba4a58-59c3-49f3-ba14-cf8e8d2b20a9", "value": "12288:83eeraTLMUZZcwp3B3ZX3PIeBlSNwfT+f9mkvAM2aCkvZXnHIi9NW579VCZ6v:je+TLM2Zdp3dWwfT+lmu8GZXnHTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623694275, "uuid": "5140c484-36a6-4864-8c5d-99d02bae4187", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623694275, "uuid": "50575d73-bcc3-4600-b016-cbf188bb0844", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623694275, "uuid": "093504dd-97d2-43f2-a143-df4519eb74d9", "value": "e5fc908b43a9096e833093739b2421b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791aa707-cd07-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623671754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671754, "uuid": "233ff4b9-7f29-4955-85a9-565e4c5926f3", "comment": "Malware payload (Loki)", "value": "d45879197ce5a42e7c810bca5e020af5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671754, "uuid": "d715de7e-833d-4183-b6fd-caa328124136", "comment": "Malware payload (Loki)", "value": "f45bfd36a12ca3ee1b05b0e05889e8be39b08a4beed3614927e1563d34c1577a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671754, "uuid": "46bbb617-02fd-4f99-8799-d907c11fd643", "comment": "Malware payload (Loki)", "value": "4b15bb48979dc4ce3829366388cf0b6cf576aff2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623671754, "uuid": "09488968-7c75-41fe-a413-7ced9c73ed23", "comment": "Malware payload (Loki)", "value": "3405cf9e93f31eb1bfd45391fc0047162214b2b03660b5d18131fe22dc9395d3edada64fd56afdaddc54ddc334d1edc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671754, "uuid": "df0db15c-ee9f-4596-ab08-6365f3a45c34", "value": "6144F136974B1940DDC40BBAADD4CC3FE0F9E740143F0AE7654A2B3FC95678BA612626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671754, "uuid": "068958b3-9190-4ffb-8fad-f96f1d6bbe4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671754, "uuid": "c00d3e7c-667c-44d9-8448-ecd087df1ec3", "value": "3072:b+03sijvc8BUJjG4Eriin2HUikp4uU4EEkweFK13IEOqlhFSacNBghyeubiKMOKC:qev3sjLTkpej1F+3hhFUmh34Bo3U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623671754, "uuid": "8930a1da-9ca7-4026-beb7-62ba989737c9", "value": 255984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623671754, "uuid": "bd98d6c6-c9bc-4aed-a98d-8ad3258c7903", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623671754, "uuid": "87242ce7-91ba-4dbc-a87a-96e1f50de3f6", "value": "d45879197ce5a42e7c810bca5e020af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46dcc32-ccd5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623650432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650432, "uuid": "74963f14-27f1-401b-ac80-48f9006c77cf", "comment": "Malware payload (Formbook)", "value": "a88d7e7e4c06bf6929da0280b998f0b7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650432, "uuid": "14053132-2501-4963-92ad-ecfe0edd6906", "comment": "Malware payload (Formbook)", "value": "f611ba47d87c22dda81b81909d4eab3a4c2cf51e495459c262dd3b51e42b11a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650432, "uuid": "9e841cac-b1fc-41ad-a3a7-5f22f5f92084", "comment": "Malware payload (Formbook)", "value": "829bab50ef5e7f18f5f0c9413863f3b1675ee1b1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650432, "uuid": "1ea41f3b-8c0d-4d43-a754-114a565cf475", "comment": "Malware payload (Formbook)", "value": "17afe2906da6719a4d30fd36a086d2c80e35e190a20c98c296418adc4bf50b9358fd212b0c3aba9ba859cc7de65b5465", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650432, "uuid": "45a8f3fb-5937-4eb6-8f35-2406e146fcaa", "value": "1C259E9C31E6A152C78B65F0147FB02EF1BDB8AE10DD05878C93E5DE6C5895AD322E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650432, "uuid": "74aed9a6-d064-4fe9-b941-ffb4b66bdf7f", "value": "1536:4FFlgqy0Tyg+fffffffffDCffNf6Eq+OkKiDtf6zrQykZr6Eq+OkKiDtfffOfPfj:4FFllFFlYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650432, "uuid": "3b9490d0-32db-4d18-ba2c-42351be3ad85", "value": 1055311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650432, "uuid": "d0c4569f-0642-4b40-84a2-218696f89143", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650432, "uuid": "c4bf421b-4d66-4fe4-8845-69f82aa96d31", "value": "Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e621f61-ccd5-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623650154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650154, "uuid": "bdd6e1c6-2f55-4b0f-9bb3-3c689e3317d7", "comment": "Malware payload (Loki)", "value": "bb8ad6d8ef89f397fd3cbac7a8f1a0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650154, "uuid": "42bb79c3-93cc-4472-974c-ecd4ed858396", "comment": "Malware payload (Loki)", "value": "f6a68e4ba2f32ae3177a3b0810b613bc169eea4d836fbb2108f0bd6206afeba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650154, "uuid": "4b4d96d4-c9bb-4045-b958-d97ac1db23a7", "comment": "Malware payload (Loki)", "value": "45a150822b5d436225671cd979aa0c30f3e64690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623650154, "uuid": "0dc4938c-1541-4b56-9194-a24cdbc70f67", "comment": "Malware payload (Loki)", "value": "0a79a805d46f78ca44d819943e45d11a249fe3ea879bf1fb5a37f3f284879ab99de58026fcd3ec16378476ce95f8978f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650154, "uuid": "75b6e8c1-ea87-4a2c-a2d4-00d7e10dc0e4", "value": "1A84E1043EDD70E9D0329FBE5DE17651A6BABD761A03DD5B2C8133094A23B82CD7162E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650154, "uuid": "dbe42e01-6c2b-40f9-bff3-6f5e89009bb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650154, "uuid": "baf2cae9-2e8d-436d-8821-ac05f2f9df6e", "value": "6144:4ZVITXwuia5BA2h0Tp48cnFUP+YeqzG1j3ZonM/8ChGPbf9+DTHHiU:4ZVITEa5BAo20nKP+L717ZonMUtbkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623650154, "uuid": "6fdabb0e-b290-48f2-b6f4-58637dc4021e", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623650154, "uuid": "754d2bfb-93c0-4537-8c52-f69089383beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623650154, "uuid": "bc56c550-8976-4df2-be7f-57abda186e91", "value": "TNT Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0df473b-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623652198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652198, "uuid": "11b40c77-aa6d-4073-b8ac-91ce3a2feafb", "comment": "Malware payload", "value": "69e585e233e8964485cc7ed1cfe7ee27", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652198, "uuid": "9499de2c-09e0-4fea-92d4-3987d868e7a4", "comment": "Malware payload", "value": "f9c1645e9c3555ddba0c1fcf5a91ab48b2bd53e68b1c59ddd5bfb33da63d6716", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652198, "uuid": "829b8d69-34ec-44a4-b143-a23004f7e7e2", "comment": "Malware payload", "value": "81e4433356ad919c382c7cdaf7fb29b4b3a46d14", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623652198, "uuid": "bb50ed96-cb1d-43ba-aecd-6ca51fbc2b65", "comment": "Malware payload", "value": "1284fc177610cc5bad298c3c68f2590ec77b99fc007dbb12e971a31b415f5ea6d4ae96bad93c1de6935ae7a479da8324", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652198, "uuid": "2dd1857f-03f8-4871-8ae0-2b2fed18de7e", "value": "14652315DEE75F4AD9BF72F89A13D908467C3C0612048E6EB31A7397B4B273163A2309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652198, "uuid": "638dad00-0b28-4454-a689-ffa2e145ebf1", "value": "24576:ilCf05GKawfMUqgzn177777LvzoJIgiCyiQcl7tghePTp2kMdvPfwa8Fh3U7k+7:2CcGwkU7z177777bzoJpiCyiNghYMKa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623652198, "uuid": "1a311684-0392-4ebb-8965-14e0b40ce9aa", "value": 1444352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623652198, "uuid": "025f597e-e56a-4152-87e3-35e76972453c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623652198, "uuid": "867408e6-a4b9-4664-9864-edf5188123bb", "value": "RFQ379938493034.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b809e767-ccdf-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623654680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654680, "uuid": "435f9ee4-1bd6-437e-9033-02c45309ebd2", "comment": "Malware payload (Loki)", "value": "f1bc817787a31ba292e96718fb5f82fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654680, "uuid": "d58ceada-f8d6-479e-85dc-3cc2e74ecf9d", "comment": "Malware payload (Loki)", "value": "fabc3fa140d11958e407662dd9358e945ea43e3c02352e1e7afeca29a1138f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654680, "uuid": "b75d7be2-2fc4-4775-b6b3-1e93c0e283ec", "comment": "Malware payload (Loki)", "value": "38a100123cf23798f1024b272fa1299addc09114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623654680, "uuid": "1ee86892-bb2a-441c-9931-2e052e0225ef", "comment": "Malware payload (Loki)", "value": "fb45aa2d7a49e99a3d35e4676ce5de9b9b3d4ac205edb29041e10ea99869071bee8a57eb5f1634695e73c4599c341304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654680, "uuid": "b41837cf-fba5-41ee-8c4f-2591982631ba", "value": "79E47D6DA2808871E8272BFD8C5AAB90193E7E503A64CC4E26F47E853F717D0792D15F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654680, "uuid": "2341d1fe-ba07-48af-99f8-2ea7f1524155", "value": "a66cda4dbc02db195dcaedc912db7cdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654680, "uuid": "092b5986-9973-4bae-8778-a897beef441a", "value": "12288:890ywyQxFTkWyDA0eOlzgnD34mG2qX0uNb+T0HXX+jBnnXLVgKR3/E:8iPPTkbY/D302q/XQB/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623654680, "uuid": "209775c9-0ab8-4122-b038-264a7fa734a0", "value": 667800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623654680, "uuid": "c88f7315-9f09-4bb9-8f44-60bea4f33f52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623654680, "uuid": "f91ee3e2-1201-4a1c-b3c4-4eb92327578a", "value": "Screenshots6132021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916dca73-cce6-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623657621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657621, "uuid": "c82b4127-a650-432f-b513-f75fba8c550b", "comment": "Malware payload (OskiStealer)", "value": "9f6f8cb5647da0fc5df0142e82ac12ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657621, "uuid": "e2996350-6092-4393-b65a-7fe7b77cfe91", "comment": "Malware payload (OskiStealer)", "value": "fac2fa827e763dfcc0b5baf189dd050db2dae4d731ec54a208c2238d4f7b55e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657621, "uuid": "3011e6cf-85f3-407d-aa0b-2fa81c1ee911", "comment": "Malware payload (OskiStealer)", "value": "1d3d073bdaac0cb8e59f90e13bb686a9602f6da6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623657621, "uuid": "963381a6-a511-4aee-b26d-0dba56f3d16d", "comment": "Malware payload (OskiStealer)", "value": "62c9da91942cadd94032c5ffd498fadf05788a36d52bd3b11d14d9e86b516372f45af7d338194dd78e1af42ebe21dfb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657621, "uuid": "7c38c389-3f38-4e6a-a830-33cd30a63065", "value": "C954026791C76141D8C60FB56EA18D2FB8FCEF04142F86E7790B293FC949AC6DB06126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657621, "uuid": "4c75fc2c-b40d-45b2-82e3-d0697d98e1fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657621, "uuid": "9817d19a-635f-40fb-8ef9-156836fd0d04", "value": "6144:45RjoQoNNBeGjaWYfIyp/5IO30Z/mPhy7NEU1:ehodKGuWYAypmA0hMHU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623657621, "uuid": "9a8c9dcb-b826-4193-bdf2-0af735e47f09", "value": 284656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623657621, "uuid": "3abdc53d-4869-4d12-b6c7-e1ce145fa8ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623657621, "uuid": "808427fc-c7a7-43b3-94e9-607e74baacce", "value": "9f6f8cb5647da0fc5df0142e82ac12ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0705f46-cd21-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623682987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623682987, "uuid": "6b1e2f8b-20e2-4679-83f9-d9f68c988146", "comment": "Malware payload (AgentTesla)", "value": "3b762cf745c32e5e3592982b0009f1a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623682987, "uuid": "192545db-b681-4d6c-9c9e-8d041770aff1", "comment": "Malware payload (AgentTesla)", "value": "fb15582e8228287a56614f780f416ee64594376e45e9bd0bda5fbe5beb26a81e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623682987, "uuid": "9510ece6-4149-490a-9df6-205d0ec1dfb4", "comment": "Malware payload (AgentTesla)", "value": "7916343223982aa062621ffdb0ac82c5cb8757a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623682987, "uuid": "57716544-bdc1-409d-a9c7-ffe53eeca65d", "comment": "Malware payload (AgentTesla)", "value": "0232a1aa89658c1aa0590b711e9be40df22e5abc62ec40b0b910534fa6d82f36c839c4ad2564d600ab654a3cdf81edfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623682987, "uuid": "a3f1e9f7-eebe-4696-a885-5b1409071471", "value": "4C9402143FEEA12AD1321FBF19E97395D6BDB9732603E26B2882134B4903F85DD5113A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623682987, "uuid": "c6c8be49-d511-4dc5-bdc8-c58e79a020ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623682987, "uuid": "dc3da1f8-9d2f-4294-8e3c-6ebc9ac9856e", "value": "6144:zyCtNV+EynuCJtqxBDr2vuJO670HwwBeyF0w9axfYb7uWgiWczE9/x9zgp1lkRLL:zyCtN0CCmxBDr2bQseXw9SfYS5t1yIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623682987, "uuid": "b858a48a-c174-42d2-a17e-4ccbd86be7f0", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623682987, "uuid": "91dd7835-e61b-4a7b-ab8d-f331f2f9f94d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623682987, "uuid": "4c3acdf1-4e7e-4a9c-b060-43b1a6e50520", "value": "TRANSFER COPY FOR SHIPMENT FROM KOREA-PAYMENTS 883-725-990-0000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6814908-ccc5-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623643537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643537, "uuid": "0fa1ad8c-1df2-4638-9d1b-2f0c9db899c4", "comment": "Malware payload (OskiStealer)", "value": "587019a76119966735b206753a44b53c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643537, "uuid": "28c1bce0-ba84-4776-9d97-4d93aa2e2839", "comment": "Malware payload (OskiStealer)", "value": "fb30ae8d4bcce71593ae5da2277634ad9ccf2964f1dc7f9997872b498753aa74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643537, "uuid": "d343a5b1-fe38-4104-af77-3daccf838ae2", "comment": "Malware payload (OskiStealer)", "value": "d3eff2720f7222908dab81df323a4e772f973e64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623643537, "uuid": "bba99834-3911-496f-9a35-2bcfc0b923e5", "comment": "Malware payload (OskiStealer)", "value": "ff81b9a17ec65bbe36235d7317dab97d025d1c0a4a62a4016ff26535f390cd7760a1c36959e18670521fcd88051ef3d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643537, "uuid": "bc139082-b2ae-41a7-a251-3cd6dd6436f8", "value": "4954F12653872141C8C60BBABCD1CC5AB5FEF750051F0EE3795E2E3FC558986AB22927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643537, "uuid": "c622954b-0ddd-4056-bf72-e1eba1f691dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643537, "uuid": "0e73b935-888d-472f-8673-4bdd10882930", "value": "6144:Ik0gWQ4beFld7Oi9wDwV3BHfckvDHgxg9VVigpS2Vl2kO8keicG1h431U1:Ik0S4iHdKi9wDwZ1frgxg9SD2LW841ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623643537, "uuid": "2ba8e174-c026-446e-bbfc-953fb8b9343b", "value": 295408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623643537, "uuid": "6cec7f5d-3ff9-4ed3-a5cb-c9d76e18926e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623643537, "uuid": "894661cb-7c08-4609-afc5-976be0c4b419", "value": "RFL0784510200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff555a5-ccea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623659444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659444, "uuid": "0c9da0cc-6b36-41b1-86dc-9b2f19be2782", "comment": "Malware payload (AgentTesla)", "value": "cf8822c02907895527c86afcbeea31bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659444, "uuid": "9b910579-68c5-464b-8669-907af42e1612", "comment": "Malware payload (AgentTesla)", "value": "fc1db35bf753762e3b01a9852002988985e876250cd343a0348a765be4fd19fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659444, "uuid": "accc643d-20ff-4124-b2ae-fb8bcbf926ac", "comment": "Malware payload (AgentTesla)", "value": "0c6e1d91062368c87f6ff8dcba24b4a38dbc24a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659444, "uuid": "32ae84fb-8a54-48bb-9698-dcbc7b1673b2", "comment": "Malware payload (AgentTesla)", "value": "cfdf60c1fb6ac02c5178ec820645f4122860675c50d4f583a8db79eca199889d0f8ab5eeca40e811a0a4e606a5f6ac2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659444, "uuid": "80759292-5b81-4668-ac15-483f2d98145e", "value": "3D05F1AC721076EEC86BD175CAA40C24EA603C7B531B5507902771EDAE7EA87CF644F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659444, "uuid": "5380276b-39a4-4843-b85f-8d2238931c43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659444, "uuid": "f479707a-f8cd-4303-8039-840840650944", "value": "24576:4NeBUdtUMRTkTXCXobS+ai0MHBWcoTTE0oR:4wBUUMkuoW+H0MwTTEPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623659444, "uuid": "6b3fad4d-0f64-47ec-a6cf-18e8046c2172", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623659444, "uuid": "1c60cfd2-f6ff-428d-a302-c980c6adf149", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659444, "uuid": "282b4f99-3997-4a41-b318-0058d333abf1", "value": "cf8822c02907895527c86afcbeea31bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734d838d-ccd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623651987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651987, "uuid": "d45a73ea-3e71-4637-9c29-f07791347402", "comment": "Malware payload (Formbook)", "value": "dd859deee6c8109f0a7449bf2600511c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651987, "uuid": "a92671ae-309f-4e0a-90e4-a02712c264d9", "comment": "Malware payload (Formbook)", "value": "fc28346240c3e23fd29d9aa548db6cd91c63567fd085e748bbab5bd27cb7c521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651987, "uuid": "16d861af-d399-4a27-b771-2aaecdeaeb9d", "comment": "Malware payload (Formbook)", "value": "4f05ebec5403e8c8c482ec1c35c93ea8e0a28010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623651987, "uuid": "e0b20ef5-cc7e-4cf9-a8e0-3d74b68033da", "comment": "Malware payload (Formbook)", "value": "335c8fd7b1091091d61164facb7d76f8b837f1a3caba2eb36767d2dbd0505527117ce51e40e5bcb6a0b091e9594be4a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651987, "uuid": "23947c38-ec01-4f7c-b2fa-44a2129ab428", "value": "7C241267F7D590FBE42943B109731777E7BFA216132E306B17342F182E29243EAA5246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651987, "uuid": "c9be861e-ac5c-46c6-b5ee-4f0ffcfad928", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651987, "uuid": "cfc75587-dcd6-46ca-ba04-d4d37d59dcc7", "value": "6144:8Qq+BAofsDrS3EEu8/4Qsr4z0Ill2ZIvkP1tyPgdLp:TBAo0D08aHsr4z0mYZIUddLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623651987, "uuid": "22e55e08-6c47-494e-a92a-c41d6bb640c0", "value": 218352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623651987, "uuid": "75d2018f-2021-42e2-8c0d-32f7fee9a0b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623651987, "uuid": "7825c339-fec1-42e5-b288-bb3806e05973", "value": "URGENT REQUEST FOR QUOTATION (RFQ REF R2100131410).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94659978-ccea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623659344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659344, "uuid": "964f009e-46ad-41b9-ad05-bc92415a6ee5", "comment": "Malware payload (AgentTesla)", "value": "1a65783611728e75101543698f0a83ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659344, "uuid": "ea2a6308-f2df-4fcb-9245-7868b195babc", "comment": "Malware payload (AgentTesla)", "value": "fc458bbb05e20047b64283485e6dbb5ec32e0e10b01ad081d76f8f418a6f30d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659344, "uuid": "f09d23fe-48ee-4ae5-a3d8-920b0e7250e0", "comment": "Malware payload (AgentTesla)", "value": "3ab61079a2427a5eb79b3b036ff3a845f96abe0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623659344, "uuid": "203d01b2-4714-41cc-9c39-d466044df01b", "comment": "Malware payload (AgentTesla)", "value": "c2b7a962f635e42b0fa81120e4e01ea330a8539ca3b5c69d7f3a4bdbbc1c835c519292345383aa9112ae3d2eca8fe617", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659344, "uuid": "2696c73a-d25b-416f-8a9e-62348c7ac60d", "value": "C005F1AC721035EFC86BC1758AA81C64EAA07C67571F4207A01334EDAE7EA87DF545F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659344, "uuid": "50ac4bfc-d036-44d9-8609-6af0c50e3421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659344, "uuid": "ad02c821-10ac-4974-a323-b34dcf4c816e", "value": "24576:hNeBUdtZaB40UtIdOLSxFMaDr3GeG68tJtzdz:hwBUcKS9r3LG6CR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623659344, "uuid": "e9d0ae1f-779c-4ffd-9003-c222d09b04d0", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623659344, "uuid": "884d8956-d283-497c-96db-423e6c001259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623659344, "uuid": "00055723-0387-4e8b-86c1-87e9775950ba", "value": "1a65783611728e75101543698f0a83ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebd2e82-ccfd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623667442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667442, "uuid": "9079b62d-6a9f-4df7-a8e5-72424bca0b97", "comment": "Malware payload (AgentTesla)", "value": "a47f39ccdfea6fafcf5172a8ad94c23e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667442, "uuid": "dd4d53de-0c46-47ff-b8c6-493ba17e26a4", "comment": "Malware payload (AgentTesla)", "value": "fdbfbe6106c728b22bd5e09caaa8e921f4da233532c36284d2ddc7c45e0ff7d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667442, "uuid": "b72226e6-898d-4f89-ac87-f61eb0f950df", "comment": "Malware payload (AgentTesla)", "value": "5e4b6505a77215c99f1c5029270cbb3912e27c01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667442, "uuid": "95771ad8-b06d-4838-863d-2e96aa9b5346", "comment": "Malware payload (AgentTesla)", "value": "24d07bfaed9b3937d4b0300436c09dd4d7c64f360e8ecfa248000e4e1e87feee85a607786fd4873907e04f1987906d6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667442, "uuid": "2c1254d0-2265-432d-8ffd-0c9fda0307e6", "value": "4C35C012B255C96AD03D89344472D1FC01F1EF8E6A28FA4B3DD0796F6DB2384CA72B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667442, "uuid": "1eee1cb5-a757-4efd-b233-9c26a00da201", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667442, "uuid": "b45f8120-ba1f-4a37-9f6a-fee50a437dce", "value": "24576:JYeGFt+9m6pFPRuMj7Wd6Edy6unMkPLd:uvb+9nrPRuMAJUPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667442, "uuid": "304aece7-f1e8-47b5-b704-1c8a9aa7938f", "value": 1153024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667442, "uuid": "904df7e8-c42e-458b-8d6d-acc8d1e65fb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667442, "uuid": "e2998a45-2983-4eed-872f-48ea4703356e", "value": "SecuriteInfo.com.ArtemisA47F39CCDFEA.14562.14798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb0633f-cce8-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623658578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658578, "uuid": "27a6fb73-849e-4b4b-9c14-36b551c7acba", "comment": "Malware payload (ArkeiStealer)", "value": "082fd1aa9ec1865c934c40f4d0da5200", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658578, "uuid": "0b7d5fc8-ac63-4c94-b746-aeb419af6e0d", "comment": "Malware payload (ArkeiStealer)", "value": "fde7164e40a4441b073b4258a7d13fee88fc2d9f6cb5d7d42cfcec774e6d6cc5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658578, "uuid": "5e1f6464-36b8-4005-8bba-a0185fc8f878", "comment": "Malware payload (ArkeiStealer)", "value": "ce5a254e5ada9562883a8c7c5629d2d86dbb0a25", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623658578, "uuid": "849f5871-4b4b-4a2f-b153-4f032dc4ac0d", "comment": "Malware payload (ArkeiStealer)", "value": "7e2741c4e173cd33230fe8d2d8202e6b40bfe418d70e6f40438438f23aaca2cc5b202ed58103d88c0872638cc34820d2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658578, "uuid": "fcf55af7-fa11-42d3-bb69-c7e1edef98e3", "value": "A375F01163958762C54F3BFC3B0DF6790855ADFF171789872BB03DCBB966E8092292A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658578, "uuid": "99c61869-8c9d-4760-a1f1-e48078daac46", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658578, "uuid": "8c486cf5-0407-44fc-9f74-301167a64875", "value": "24576:r9btxEOImkRpPFUEbFK18xC6fULsX3V33tPin5Ygz6k6dF2Ck/hJp56W5F2w:rNNrOJFrVNPS5YxJQnfp5tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623658578, "uuid": "de0c2250-fc86-4fa9-bc74-dfd13aa169fd", "value": 1680796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623658578, "uuid": "84e46729-ccec-489d-81ac-7a83bbf89faf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623658578, "uuid": "c4e134a3-c588-4eca-b15d-a443365d7d62", "value": "082fd1aa9ec1865c934c40f4d0da5200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65db7be-cca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gelsemium)", "timestamp": 1623629390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629390, "uuid": "54be7258-cd58-4d8c-95bf-8db137ba9bb2", "comment": "Malware payload (Gelsemium)", "value": "d1a505f2a335a8aa05d3b74358157ff3", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629390, "uuid": "a7694061-348b-479f-b116-cb926c98c13f", "comment": "Malware payload (Gelsemium)", "value": "fe71b66d65d5ff9d03a47197c99081d9ec8d5f6e95143bdc33f5ea2ac0ae5762", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629390, "uuid": "869476ea-5698-47b2-9e13-95e720712a4c", "comment": "Malware payload (Gelsemium)", "value": "1042c798d7ff69eb52cbeae684c74fc0ee84aacd", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623629390, "uuid": "ff9e3596-8a48-418b-b7c6-271e16091277", "comment": "Malware payload (Gelsemium)", "value": "ccd7e0d08df03ed5908ee80529c0610b6809bf3dd3b792cfa92dd0959fda28028e3beb7957b2bc0b614a63f097f79981", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gelsemine", "colour": "#52420E", "exportable": true, "hide_tag": false }, { "name": "Gelsemium", "colour": "#FC8FAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629390, "uuid": "92cbbd34-c66e-4906-9da3-c69fafbd24f0", "value": "BBA4020ABB9102D5F0381939F5E766BF8B3BBD031146A5AB9B00B89E4C72341E1573ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629390, "uuid": "0c18185d-6396-4086-9ff0-9fb79b0b9ba1", "value": "e7c6946f3ca6926ed51f9cfbd26ec1dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629390, "uuid": "dd978566-db83-4d49-8270-5d349a49186a", "value": "12288:48y8S9PKtT/78C21mVrq+lQdUT+qsOg1J0zkmeRnBIFix8mOX7RRZ:1FyStT/783mVtlQdg+qRgf0wmkBKvlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623629390, "uuid": "004e08e8-7f0f-4c5a-bf53-4f76f5bfe15d", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623629390, "uuid": "340fcc86-12b8-4c8a-8bbf-89d076c41b2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623629390, "uuid": "94095412-ae25-4fb7-b92c-fc8a323e7a1c", "value": "fe71b66d65d5ff9d03a47197c99081d9ec8d5f6e95143bdc33f5ea2ac0ae5762.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c9ea60-cd0e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623674644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674644, "uuid": "12b9efc4-d2e9-4e6e-b626-59349dcbd3ea", "comment": "Malware payload", "value": "8f7541ea0a2213cb4657071d0f56cbd5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674644, "uuid": "458b968b-95d4-488c-9ed5-abdb03dc1325", "comment": "Malware payload", "value": "ff9daf079a26af2062fd0e07c8333abbaf2b0fef84cfe6fbd7403d161ce62837", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674644, "uuid": "4babcbdf-7c6f-4145-854a-16aeaadd4971", "comment": "Malware payload", "value": "bc72ab489b10d80c6fc4517d32f9d9fa1ccd784c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623674644, "uuid": "3c25f6b9-eaeb-4509-9913-c5d1f230898f", "comment": "Malware payload", "value": "e58abc389e537c0c894047d73ab86ebd3eb9934262ad5a2494ae62383438f7dcdaa15102eaf3947a299b547a83a522e6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674644, "uuid": "5c07edbe-1c8d-4ebf-9aa7-6826cc68139a", "value": "9F8423B172C0D143D91B6A7363AE0A744B16DD509E5E42236B0C726E1F726252F88FEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674644, "uuid": "2387aefc-5fdd-4a7d-a4cc-0b561cfcc215", "value": "3ce4bda989f262d7555b0ff406096ca0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674644, "uuid": "0b5ce97a-0e19-413b-a4b2-5f789bc94807", "value": "6144:7/jDcGVk8eo+AZ0Ocl531ruN1DJjsIj+TzGgC2K/xbkMgeKfzJMC/uu9aP:7/MGsj2KVc5hVj+HGgTK/p6eKyC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623674644, "uuid": "8d8b6f68-e8a2-4ba1-9658-63c5477fb810", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623674644, "uuid": "31701c32-5fe3-4156-a207-1224bf702699", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623674644, "uuid": "da5068b3-1375-4023-876d-0edc2cd970e8", "value": "xwebpic10.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d0fb9f-ccfe-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1623667885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667885, "uuid": "ba5fe71f-49fb-46c0-910c-a1a1d4092a65", "comment": "Malware payload (DiamondFox)", "value": "b1467f58f71f1ddf6e81e00493be8525", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667885, "uuid": "cfa36623-2444-424e-b8bb-cd9caa861dac", "comment": "Malware payload (DiamondFox)", "value": "ffd34b321cc06d7af0ade5bbef7db266c91382c5ec49937f14475e974f9bf608", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667885, "uuid": "70df5900-66c8-4c06-9ba6-349d16f3bb5a", "comment": "Malware payload (DiamondFox)", "value": "b28ac693c1255ae998ce7d3ca954de91793673d9", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623667885, "uuid": "74056129-6e67-4ff6-b21b-39485bac9392", "comment": "Malware payload (DiamondFox)", "value": "105738cca54681295c82576bd3517824e77b669cf1f225217e8edc3a1c5826c352d6987f6a1579bf142981550f98fe90", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667885, "uuid": "9bee7aee-71e0-4dff-a874-4c29a20bfac4", "value": "2416332176F284BBD8515134AE8D6F76BAEEC39907309DD7E3309A0D857C808DA1BE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667885, "uuid": "6afb89dd-dfac-4d3e-985f-8367fb7a8669", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667885, "uuid": "aca777c2-55cb-497a-a835-6ee09c9079dd", "value": "98304:xnCvLUBsgUtB/0L+WH13KBo0D1KBQaCr5+vxkP7k:xELUCgQZ0LzGtD1KVyrP7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623667885, "uuid": "415a42d9-b470-4e5b-9cd8-bba3a16cd096", "value": 4089889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623667885, "uuid": "299e22ef-b978-4f08-b80a-d32a8123e314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623667885, "uuid": "562e0a2a-5030-4bdd-bbd1-88bd198e6677", "value": "b1467f58f71f1ddf6e81e00493be8525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }